FSetPositive.v

Built with Alectryon, running Coq+SerAPI v8.10.0+0.7.0. Coq sources are in this panel; goals and messages will appear in the other. Bubbles () indicate interactive fragments: hover for details, tap to reveal contents. Use Ctrl+↑ Ctrl+↓ to navigate, Ctrl+🖱️ to focus.

(************************************************************************)
(*         *   The Coq Proof Assistant / The Coq Development Team       *)
(*  v      *   INRIA, CNRS and contributors - Copyright 1999-2018       *)
(* <O___,, *       (see CREDITS file for the list of authors)           *)
(*   \VV/  **************************************************************)
(*    //   *    This file is distributed under the terms of the         *)
(*         *     GNU Lesser General Public License Version 2.1          *)
(*         *     (see LICENSE file for the text of the license)         *)
(************************************************************************)

Efficient implementation of FSetInterface.S for positive keys, inspired from the FMapPositive module.

This module was adapted by Alexandre Ren, Damien Pous, and Thomas Braibant (2010, LIG, CNRS, UMR 5217), from the FMapPositive module of Pierre Letouzey and Jean-Christophe Filliâtre, which in turn comes from the FMap framework of a work by Xavier Leroy and Sandrine Blazy (used for building certified compilers).

Require Import Bool BinPos OrderedType OrderedTypeEx FSetInterface.

Set Implicit Arguments.
Local Open Scope lazy_bool_scope.
Local Open Scope positive_scope.
Local Unset Elimination Schemes.

Module PositiveSet <: S with Module E:=PositiveOrderedTypeBits.

  Module E:=PositiveOrderedTypeBits.

  Definition elt := positive : Type.

  Inductive tree :=
    | Leaf : tree
    | Node : tree -> bool -> tree -> tree.

  Scheme tree_ind := Induction for tree Sort Prop.

  Definition t := tree : Type.

  Definition empty : t := Leaf.

  Fixpoint is_empty (m : t) : bool :=
   match m with
    | Leaf => true
    | Node l b r => negb b &&& is_empty l &&& is_empty r
   end.

  Fixpoint mem (i : elt) (m : t) {struct m} : bool :=
    match m with
    | Leaf => false
    | Node l o r =>
        match i with
        | 1 => o
        | i~0 => mem i l
        | i~1 => mem i r
        end
    end.

  Fixpoint add (i : elt) (m : t) : t :=
    match m with
    | Leaf =>
        match i with
        | 1 => Node Leaf true Leaf
        | i~0 => Node (add i Leaf) false Leaf
        | i~1 => Node Leaf false (add i Leaf)
        end
    | Node l o r =>
        match i with
        | 1 => Node l true r
        | i~0 => Node (add i l) o r
        | i~1 => Node l o (add i r)
        end
    end.

  Definition singleton i := add i empty.

helper function to avoid creating empty trees that are not leaves

  Definition node (l : t) (b: bool) (r : t) : t :=
    if b then Node l b r else
     match l,r with
       | Leaf,Leaf => Leaf
       | _,_ => Node l false r end.

  Fixpoint remove (i : elt) (m : t) {struct m} : t :=
    match m with
      | Leaf => Leaf
      | Node l o r =>
        match i with
          | 1 => node l false r
          | i~0 => node (remove i l) o r
          | i~1 => node l o (remove i r)
        end
    end.

  Fixpoint union (m m': t) : t :=
    match m with
      | Leaf => m'
      | Node l o r =>
        match m' with
          | Leaf => m
          | Node l' o' r' => Node (union l l') (o||o') (union r r')
        end
    end.

  Fixpoint inter (m m': t) : t :=
    match m with
      | Leaf => Leaf
      | Node l o r =>
        match m' with
          | Leaf => Leaf
          | Node l' o' r' => node (inter l l') (o&&o') (inter r r')
        end
    end.

  Fixpoint diff (m m': t) : t :=
    match m with
      | Leaf => Leaf
      | Node l o r =>
        match m' with
          | Leaf => m
          | Node l' o' r' => node (diff l l') (o&&negb o') (diff r r')
        end
    end.

  Fixpoint equal (m m': t): bool :=
    match m with
      | Leaf => is_empty m'
      | Node l o r =>
        match m' with
          | Leaf => is_empty m
          | Node l' o' r' => eqb o o' &&& equal l l' &&& equal r r'
        end
    end.

  Fixpoint subset (m m': t): bool :=
    match m with
      | Leaf => true
      | Node l o r =>
        match m' with
          | Leaf => is_empty m
          | Node l' o' r' => (negb o ||| o') &&& subset l l' &&& subset r r'
        end
    end.

reverses y and concatenate it with x

  Fixpoint rev_append (y x : elt) : elt :=
    match y with
      | 1 => x
      | y~1 => rev_append y x~1
      | y~0 => rev_append y x~0
    end.
  Infix "@" := rev_append (at level 60).
  Definition rev x := x@1.

  Section Fold.

    Variable B : Type.
    Variable f : elt -> B -> B.

the additional argument, i, records the current path, in reverse order (this should be more efficient: we reverse this argument only at present nodes only, rather than at each node of the tree). we also use this convention in all functions below

    Fixpoint xfold (m : t) (v : B) (i : elt) :=
      match m with
        | Leaf => v
        | Node l true r =>
          xfold r (f (rev i) (xfold l v i~0)) i~1
        | Node l false r =>
          xfold r (xfold l v i~0) i~1
      end.
    Definition fold m i := xfold m i 1.

  End Fold.

  Section Quantifiers.

    Variable f : elt -> bool.

    Fixpoint xforall (m : t) (i : elt) :=
      match m with
        | Leaf => true
        | Node l o r =>
          (negb o ||| f (rev i)) &&& xforall r i~1 &&& xforall l i~0
      end.
    Definition for_all m := xforall m 1.

    Fixpoint xexists (m : t) (i : elt) :=
      match m with
        | Leaf => false
        | Node l o r => (o &&& f (rev i)) ||| xexists r i~1 ||| xexists l i~0
      end.
    Definition exists_ m := xexists m 1.

    Fixpoint xfilter (m : t) (i : elt) : t :=
      match m with
        | Leaf => Leaf
        | Node l o r => node (xfilter l i~0) (o &&& f (rev i)) (xfilter r i~1)
      end.
    Definition filter m := xfilter m 1.

    Fixpoint xpartition (m : t) (i : elt) : t * t :=
      match m with
        | Leaf => (Leaf,Leaf)
        | Node l o r =>
          let (lt,lf) := xpartition l i~0 in
          let (rt,rf) := xpartition r i~1 in
             if o then
               let fi := f (rev i) in
                 (node lt fi rt, node lf (negb fi) rf)
             else
                 (node lt false rt, node lf false rf)
      end.
    Definition partition m := xpartition m 1.

  End Quantifiers.

uses a to accumulate values rather than doing a lot of concatenations

  Fixpoint xelements (m : t) (i : elt) (a: list elt) :=
    match m with
      | Leaf => a
      | Node l false r => xelements l i~0 (xelements r i~1 a)
      | Node l true r => xelements l i~0 (rev i :: xelements r i~1 a)
    end.

  Definition elements (m : t) := xelements m 1 nil.

  Fixpoint cardinal (m : t) : nat :=
    match m with
      | Leaf => O
      | Node l false r => (cardinal l + cardinal r)%nat
      | Node l true r => S (cardinal l + cardinal r)
    end.

  Definition omap (f: elt -> elt) x :=
    match x with
      | None => None
      | Some i => Some (f i)
    end.

would it be more efficient to use a path like in the above functions ?

  Fixpoint choose (m: t) : option elt :=
    match m with
      | Leaf => None
      | Node l o r => if o then Some 1 else
        match choose l with
          | None => omap xI (choose r)
          | Some i => Some i~0
        end
    end.

  Fixpoint min_elt (m: t) : option elt :=
    match m with
      | Leaf => None
      | Node l o r =>
        match min_elt l with
          | None => if o then Some 1 else omap xI (min_elt r)
          | Some i => Some i~0
        end
    end.

  Fixpoint max_elt (m: t) : option elt :=
    match m with
      | Leaf => None
      | Node l o r =>
        match max_elt r with
          | None => if o then Some 1 else omap xO (max_elt l)
          | Some i => Some i~1
        end
    end.

lexicographic product, defined using a notation to keep things lazy

  Notation lex u v := match u with Eq => v | Lt => Lt | Gt => Gt end.

  Definition compare_bool a b :=
    match a,b with
      | false, true => Lt
      | true, false => Gt
      | _,_ => Eq
    end.

  Fixpoint compare_fun (m m': t): comparison :=
    match m,m' with
      | Leaf,_ => if is_empty m' then Eq else Lt
      | _,Leaf => if is_empty m then Eq else Gt
      | Node l o r,Node l' o' r' =>
        lex (compare_bool o o') (lex (compare_fun l l') (compare_fun r r'))
    end.


  Definition In i t := mem i t = true.
  Definition Equal s s' := forall a : elt, In a  s <-> In a  s'.
  Definition Subset s s' := forall a : elt, In a s -> In a s'.
  Definition Empty s := forall a : elt, ~ In a s.
  Definition For_all (P : elt -> Prop) s := forall x, In x s -> P x.
  Definition Exists (P : elt -> Prop) s := exists x, In x s /\ P x.

  Notation "s  [=]  t" := (Equal s t) (at level 70, no associativity).
  Notation "s  [<=]  t" := (Subset s t) (at level 70, no associativity).

  Definition eq := Equal.

  Declare Equivalent Keys Equal eq.

  Definition lt m m' := compare_fun m m' = Lt.

Specification of In

  Lemma In_1: forall s x y, E.eq x y -> In x s -> In y s.forall (s : t) (x y : positive),
E.eq x y -> In x s -> In y s
  Proof.forall (s : t) (x y : positive),
E.eq x y -> In x s -> In y s intros s x y ->.s:t
y:positive
In y s -> In y s trivial. Qed.

Specification of eq

  Lemma eq_refl: forall s, eq s s.forall s : t, eq s s
  Proof.forall s : t, eq s s unfold eq, Equal.forall (s : t) (a : elt), In a s <-> In a s reflexivity. Qed.

  Lemma eq_sym: forall s s', eq s s' -> eq s' s.forall s s' : t, eq s s' -> eq s' s
  Proof.forall s s' : t, eq s s' -> eq s' s unfold eq, Equal.forall s s' : t,
(forall a : elt, In a s <-> In a s') ->
forall a : elt, In a s' <-> In a s intros.s, s':t
H:forall a0 : elt, In a0 s <-> In a0 s'
a:elt
In a s' <-> In a s symmetry.s, s':t
H:forall a0 : elt, In a0 s <-> In a0 s'
a:elt
In a s <-> In a s' trivial. Qed.

  Lemma eq_trans: forall s s' s'', eq s s' -> eq s' s'' -> eq s s''.forall s s' s'' : t, eq s s' -> eq s' s'' -> eq s s''
  Proof.forall s s' s'' : t, eq s s' -> eq s' s'' -> eq s s'' unfold eq, Equal.forall s s' s'' : t,
(forall a : elt, In a s <-> In a s') ->
(forall a : elt, In a s' <-> In a s'') ->
forall a : elt, In a s <-> In a s'' intros ? ? ? H ? ?.s, s', s'':t
H:forall a0 : elt, In a0 s <-> In a0 s'
H0:forall a0 : elt, In a0 s' <-> In a0 s''
a:elt
In a s <-> In a s'' rewrite H.s, s', s'':t
H:forall a0 : elt, In a0 s <-> In a0 s'
H0:forall a0 : elt, In a0 s' <-> In a0 s''
a:elt
In a s' <-> In a s'' trivial. Qed.

Specification of mem

  Lemma mem_1: forall s x, In x s -> mem x s = true.forall (s : t) (x : elt), In x s -> mem x s = true
  Proof.forall (s : t) (x : elt), In x s -> mem x s = true unfold In.forall (s : t) (x : elt),
mem x s = true -> mem x s = true trivial. Qed.

  Lemma mem_2: forall s x, mem x s = true -> In x s.forall (s : t) (x : elt), mem x s = true -> In x s
  Proof.forall (s : t) (x : elt), mem x s = true -> In x s unfold In.forall (s : t) (x : elt),
mem x s = true -> mem x s = true trivial. Qed.

Additional lemmas for mem

  Lemma mem_Leaf: forall x, mem x Leaf = false.forall x : elt, mem x Leaf = false
  Proof.forall x : elt, mem x Leaf = false destruct x; trivial. Qed.

Specification of empty

  Lemma empty_1 : Empty empty.Empty empty
  Proof.Empty empty unfold Empty, In.forall a : elt, mem a empty <> true intro.a:elt
mem a empty <> true rewrite mem_Leaf.a:elt
false <> true discriminate. Qed.

Specification of node

  Lemma mem_node: forall x l o r, mem x (node l o r) = mem x (Node l o r).forall (x : elt) (l : t) (o : bool) (r : t),
mem x (node l o r) = mem x (Node l o r)
  Proof.forall (x : elt) (l : t) (o : bool) (r : t),
mem x (node l o r) = mem x (Node l o r)
    intros x l o r.x:elt
l:t
o:bool
r:t
mem x (node l o r) = mem x (Node l o r)
    case o; trivial.x:elt
l:t
o:bool
r:t
mem x (node l false r) = mem x (Node l false r)
    destruct l; trivial.x:elt
o:bool
r:t
mem x (node Leaf false r) = mem x (Node Leaf false r)
    destruct r; trivial.x:elt
o:bool
mem x (node Leaf false Leaf) =
mem x (Node Leaf false Leaf)
    now destruct x.
  Qed.
  Local Opaque node.

Specification of is_empty

  Lemma is_empty_spec: forall s, Empty s <-> is_empty s = true.forall s : t, Empty s <-> is_empty s = true
  Proof.forall s : t, Empty s <-> is_empty s = true
    unfold Empty, In.forall s : t,
(forall a : elt, mem a s <> true) <->
is_empty s = true
    induction s as [|l IHl o r IHr]; simpl.(elt -> false <> true) <-> true = true
l:tree
o:bool
r:tree
IHl:(forall a : elt, mem a l <> true) <-> is_empty l = true
IHr:(forall a : elt, mem a r <> true) <-> is_empty r = true
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => o
 end <> true) <->
negb o &&& is_empty l &&& is_empty r = true now split.l:tree
o:bool
r:tree
IHl:(forall a : elt, mem a l <> true) <-> is_empty l = true
IHr:(forall a : elt, mem a r <> true) <-> is_empty r = true
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => o
 end <> true) <->
negb o &&& is_empty l &&& is_empty r = true
      rewrite <- 2andb_lazy_alt, 2andb_true_iff, <- IHl, <- IHr.l:tree
o:bool
r:tree
IHl:(forall a : elt, mem a l <> true) <-> is_empty l = true
IHr:(forall a : elt, mem a r <> true) <-> is_empty r = true
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => o
 end <> true) <->
(negb o = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) clear IHl IHr.l:tree
o:bool
r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => o
 end <> true) <->
(negb o = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
      destruct o; simpl; split.l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => true
 end <> true) ->
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
        intro H.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true elim (H 1).l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
true = true
l, r:tree
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true reflexivity.l, r:tree
(false = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end <> true
l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
        intuition discriminate.l, r:tree
(forall a : elt,
 match a with
 | i~1 => mem i r
 | i~0 => mem i l
 | 1 => false
 end <> true) ->
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
        intro H.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true)
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true split.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
true = true /\ (forall a : elt, mem a l <> true)
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true split.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
true = true
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a l <> true
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true reflexivity.l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a l <> true
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
          intro a.l, r:tree
H:forall a0 : elt,
match a0 with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
a:elt
mem a l <> true
l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true apply (H a~0).l, r:tree
H:forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
forall a : elt, mem a r <> true
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
          intro a.l, r:tree
H:forall a0 : elt,
match a0 with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
a:elt
mem a r <> true
l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true apply (H a~1).l, r:tree
(true = true /\ (forall a : elt, mem a l <> true)) /\
(forall a : elt, mem a r <> true) ->
forall a : elt,
match a with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end <> true
        intros H [a|a|]; apply H || intro; discriminate.
  Qed.

  Lemma is_empty_1: forall s, Empty s -> is_empty s = true.forall s : t, Empty s -> is_empty s = true
  Proof.forall s : t, Empty s -> is_empty s = true intro.s:t
Empty s -> is_empty s = true rewrite is_empty_spec.s:t
is_empty s = true -> is_empty s = true trivial. Qed.

  Lemma is_empty_2: forall s, is_empty s = true -> Empty s.forall s : t, is_empty s = true -> Empty s
  Proof.forall s : t, is_empty s = true -> Empty s intro.s:t
is_empty s = true -> Empty s rewrite is_empty_spec.s:t
is_empty s = true -> is_empty s = true trivial. Qed.

Specification of subset

  Lemma subset_Leaf_s: forall s, Leaf [<=] s.forall s : t, Leaf [<=] s
  Proof.forall s : t, Leaf [<=] s intros s i Hi.s:t
i:elt
Hi:In i Leaf
In i s elim (empty_1 Hi). Qed.

  Lemma subset_spec: forall s s', s [<=] s' <-> subset s s' = true.forall s s' : t, s [<=] s' <-> subset s s' = true
  Proof.forall s s' : t, s [<=] s' <-> subset s s' = true
    induction s as [|l IHl o r IHr]; intros [|l' o' r']; simpl.Leaf [<=] Leaf <-> true = true
l':tree
o':bool
r':tree
Leaf [<=] Node l' o' r' <-> true = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l o r [<=] Leaf <->
negb o &&& is_empty l &&& is_empty r = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
      split; intros.H:Leaf [<=] Leaf
true = true
H:true = true
Leaf [<=] Leaf
l':tree
o':bool
r':tree
Leaf [<=] Node l' o' r' <-> true = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l o r [<=] Leaf <->
negb o &&& is_empty l &&& is_empty r = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true reflexivity.H:true = true
Leaf [<=] Leaf
l':tree
o':bool
r':tree
Leaf [<=] Node l' o' r' <-> true = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l o r [<=] Leaf <->
negb o &&& is_empty l &&& is_empty r = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true apply subset_Leaf_s.l':tree
o':bool
r':tree
Leaf [<=] Node l' o' r' <-> true = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l o r [<=] Leaf <->
negb o &&& is_empty l &&& is_empty r = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true

      split; intros.l':tree
o':bool
r':tree
H:Leaf [<=] Node l' o' r'
true = true
l':tree
o':bool
r':tree
H:true = true
Leaf [<=] Node l' o' r'
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l o r [<=] Leaf <->
negb o &&& is_empty l &&& is_empty r = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true reflexivity.l':tree
o':bool
r':tree
H:true = true
Leaf [<=] Node l' o' r'
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l o r [<=] Leaf <->
negb o &&& is_empty l &&& is_empty r = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true apply subset_Leaf_s.l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l o r [<=] Leaf <->
negb o &&& is_empty l &&& is_empty r = true
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true

      rewrite <- 2andb_lazy_alt, 2andb_true_iff, <- 2is_empty_spec.l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l o r [<=] Leaf <->
(negb o = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
      destruct o; simpl.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l true r [<=] Leaf <->
(false = true /\ Empty l) /\ Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l false r [<=] Leaf <->
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
        split.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l true r [<=] Leaf ->
(false = true /\ Empty l) /\ Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
(false = true /\ Empty l) /\ Empty r ->
Node l true r [<=] Leaf
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l false r [<=] Leaf <->
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
          intro H.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l true r [<=] Leaf
(false = true /\ Empty l) /\ Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
(false = true /\ Empty l) /\ Empty r ->
Node l true r [<=] Leaf
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l false r [<=] Leaf <->
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true elim (@empty_1 1).l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l true r [<=] Leaf
In 1 empty
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
(false = true /\ Empty l) /\ Empty r ->
Node l true r [<=] Leaf
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l false r [<=] Leaf <->
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true apply H.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l true r [<=] Leaf
In 1 (Node l true r)
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
(false = true /\ Empty l) /\ Empty r ->
Node l true r [<=] Leaf
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l false r [<=] Leaf <->
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true reflexivity.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
(false = true /\ Empty l) /\ Empty r ->
Node l true r [<=] Leaf
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l false r [<=] Leaf <->
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
          intuition discriminate.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Node l false r [<=] Leaf <->
(true = true /\ Empty l) /\ Empty r
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
        split; intro H.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
(true = true /\ Empty l) /\ Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
          split.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
true = true /\ Empty l
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true split.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
true = true
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty l
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true reflexivity.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty l
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
          unfold Empty.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
forall a : elt, ~ In a l
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true intros a H1.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
a:elt
H1:In a l
False
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true apply (@empty_1 (a~0)).l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
a:elt
H1:In a l
In a~0 empty
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true apply H.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
a:elt
H1:In a l
In a~0 (Node l false r)
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true assumption.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
Empty r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
          unfold Empty.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
forall a : elt, ~ In a r
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true intros a H1.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
a:elt
H1:In a r
False
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true apply (@empty_1 (a~1)).l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
a:elt
H1:In a r
In a~1 empty
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true apply H.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:Node l false r [<=] Leaf
a:elt
H1:In a r
In a~1 (Node l false r)
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true assumption.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
H:(true = true /\ Empty l) /\ Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
          destruct H as [[_ Hl] Hr].l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Hl:Empty l
Hr:Empty r
Node l false r [<=] Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
          intros [i|i|] Hi.l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Hl:Empty l
Hr:Empty r
i:positive
Hi:In i~1 (Node l false r)
In i~1 Leaf
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Hl:Empty l
Hr:Empty r
i:positive
Hi:In i~0 (Node l false r)
In i~0 Leaf
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Hl:Empty l
Hr:Empty r
Hi:In 1 (Node l false r)
In 1 Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
            elim (Hr i Hi).l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Hl:Empty l
Hr:Empty r
i:positive
Hi:In i~0 (Node l false r)
In i~0 Leaf
l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Hl:Empty l
Hr:Empty r
Hi:In 1 (Node l false r)
In 1 Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
            elim (Hl i Hi).l, r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
Hl:Empty l
Hr:Empty r
Hi:In 1 (Node l false r)
In 1 Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true
            discriminate.l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o') &&& subset l l' &&& subset r r' = true

      rewrite <- 2andb_lazy_alt, 2andb_true_iff, <- IHl, <- IHr.l:tree
o:bool
r:tree
IHl:forall s' : t, l [<=] s' <-> subset l s' = true
IHr:forall s' : t, r [<=] s' <-> subset r s' = true
l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o' = true /\ l [<=] l') /\ r [<=] r' clear.l:tree
o:bool
r, l':tree
o':bool
r':tree
Node l o r [<=] Node l' o' r' <->
(negb o ||| o' = true /\ l [<=] l') /\ r [<=] r'
      destruct o; simpl.l, r, l':tree
o':bool
r':tree
Node l true r [<=] Node l' o' r' <->
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
       split; intro H.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
(o' = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
         split.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
o' = true /\ l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' split.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
o' = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
          destruct o'; trivial.l, r, l', r':tree
H:Node l true r [<=] Node l' false r'
false = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
          specialize (H 1).l, r, l', r':tree
H:In 1 (Node l true r) -> In 1 (Node l' false r')
false = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' unfold In in H.l, r, l', r':tree
H:mem 1 (Node l true r) = true ->
mem 1 (Node l' false r') = true
false = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' simpl in H.l, r, l', r':tree
H:true = true -> false = true
false = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' apply H.l, r, l', r':tree
H:true = true -> false = true
true = true
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' reflexivity.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
          intros i Hi.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
i:elt
Hi:In i l
In i l'
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' apply (H i~0).l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
i:elt
Hi:In i l
In i~0 (Node l true r)
l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' apply Hi.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
          intros i Hi.l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
i:elt
Hi:In i r
In i r'
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' apply (H i~1).l, r, l':tree
o':bool
r':tree
H:Node l true r [<=] Node l' o' r'
i:elt
Hi:In i r
In i~1 (Node l true r)
l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' apply Hi.l, r, l':tree
o':bool
r':tree
H:(o' = true /\ l [<=] l') /\ r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
         destruct H as [[Ho' Hl] Hr].l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Node l true r [<=] Node l' o' r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' rewrite Ho'.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Node l true r [<=] Node l' true r'
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
          intros i Hi.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:elt
Hi:In i (Node l true r)
In i (Node l' true r')
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' destruct i.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~1 (Node l true r)
In i~1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l true r)
In i~0 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
            apply (Hr i).l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~1 (Node l true r)
In i r
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l true r)
In i~0 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' assumption.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l true r)
In i~0 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
            apply (Hl i).l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l true r)
In i l
l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r' assumption.l, r, l':tree
o':bool
r':tree
Ho':o' = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l true r)
In 1 (Node l' true r')
l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
            assumption.l, r, l':tree
o':bool
r':tree
Node l false r [<=] Node l' o' r' <->
(true = true /\ l [<=] l') /\ r [<=] r'
       split; intros.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
(true = true /\ l [<=] l') /\ r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r'
         split.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
true = true /\ l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r' split.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
true = true
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r' reflexivity.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
l [<=] l'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r'
           intros i Hi.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
i:elt
Hi:In i l
In i l'
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r' apply (H i~0).l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
i:elt
Hi:In i l
In i~0 (Node l false r)
l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r' apply Hi.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
r [<=] r'
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r'
           intros i Hi.l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
i:elt
Hi:In i r
In i r'
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r' apply (H i~1).l, r, l':tree
o':bool
r':tree
H:Node l false r [<=] Node l' o' r'
i:elt
Hi:In i r
In i~1 (Node l false r)
l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r' apply Hi.l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
Node l false r [<=] Node l' o' r'
           intros i Hi.l, r, l':tree
o':bool
r':tree
H:(true = true /\ l [<=] l') /\ r [<=] r'
i:elt
Hi:In i (Node l false r)
In i (Node l' o' r') destruct i; destruct H as [[H Hl] Hr].l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~1 (Node l false r)
In i~1 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l false r)
In i~0 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r')
             apply (Hr i).l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~1 (Node l false r)
In i r
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l false r)
In i~0 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r') assumption.l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l false r)
In i~0 (Node l' o' r')
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r')
             apply (Hl i).l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
i:positive
Hi:In i~0 (Node l false r)
In i l
l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r') assumption.l, r, l':tree
o':bool
r':tree
H:true = true
Hl:l [<=] l'
Hr:r [<=] r'
Hi:In 1 (Node l false r)
In 1 (Node l' o' r')
             discriminate Hi.
  Qed.


  Lemma subset_1: forall s s', Subset s s' -> subset s s' = true.forall s s' : t, s [<=] s' -> subset s s' = true
  Proof.forall s s' : t, s [<=] s' -> subset s s' = true intros s s'.s, s':t
s [<=] s' -> subset s s' = true apply -> subset_spec; trivial. Qed.

  Lemma subset_2: forall s s', subset s s' = true -> Subset s s'.forall s s' : t, subset s s' = true -> s [<=] s'
  Proof.forall s s' : t, subset s s' = true -> s [<=] s' intros s s'.s, s':t
subset s s' = true -> s [<=] s' apply <- subset_spec; trivial. Qed.

Specification of equal (via subset)

  Lemma equal_subset: forall s s', equal s s' = subset s s' && subset s' s.forall s s' : t,
equal s s' = subset s s' && subset s' s
  Proof.forall s s' : t,
equal s s' = subset s s' && subset s' s
    induction s as [|l IHl o r IHr]; intros [|l' o' r']; simpl; trivial.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb o &&& is_empty l &&& is_empty r =
negb o &&& is_empty l &&& is_empty r && true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r)
      destruct o.l, r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb true &&& is_empty l &&& is_empty r =
negb true &&& is_empty l &&& is_empty r && true
l, r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb false &&& is_empty l &&& is_empty r =
negb false &&& is_empty l &&& is_empty r && true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r) reflexivity.l, r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb false &&& is_empty l &&& is_empty r =
negb false &&& is_empty l &&& is_empty r && true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r) rewrite andb_comm.l, r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
negb false &&& is_empty l &&& is_empty r =
true && (negb false &&& is_empty l &&& is_empty r)
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r) reflexivity.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' =
(negb o ||| o') &&& subset l l' &&& subset r r' &&
((negb o' ||| o) &&& subset l' l &&& subset r' r)
      rewrite <- 6andb_lazy_alt.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' && equal l l' && equal r r' =
(negb o ||| o') && subset l l' && subset r r' &&
((negb o' ||| o) && subset l' l && subset r' r) rewrite eq_iff_eq_true.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
eqb o o' && equal l l' && equal r r' = true <->
(negb o ||| o') && subset l l' && subset r r' &&
((negb o' ||| o) && subset l' l && subset r' r) = true
       rewrite 7andb_true_iff, eqb_true_iff.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
(o = o' /\ equal l l' = true) /\ equal r r' = true <->
((negb o ||| o' = true /\ subset l l' = true) /\
 subset r r' = true) /\
(negb o' ||| o = true /\ subset l' l = true) /\
subset r' r = true
      rewrite IHl, IHr, 2andb_true_iff.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = subset l s' && subset s' l
IHr:forall s' : t, equal r s' = subset r s' && subset s' r
l':tree
o':bool
r':tree
(o = o' /\ subset l l' = true /\ subset l' l = true) /\
subset r r' = true /\ subset r' r = true <->
((negb o ||| o' = true /\ subset l l' = true) /\
 subset r r' = true) /\
(negb o' ||| o = true /\ subset l' l = true) /\
subset r' r = true clear IHl IHr.l:tree
o:bool
r, l':tree
o':bool
r':tree
(o = o' /\ subset l l' = true /\ subset l' l = true) /\
subset r r' = true /\ subset r' r = true <->
((negb o ||| o' = true /\ subset l l' = true) /\
 subset r r' = true) /\
(negb o' ||| o = true /\ subset l' l = true) /\
subset r' r = true intuition subst.l, r, l':tree
o':bool
r':tree
H0:subset r r' = true
H3:subset r' r = true
H1:subset l l' = true
H4:subset l' l = true
negb o' ||| o' = true
l, r, l':tree
o':bool
r':tree
H0:subset r r' = true
H3:subset r' r = true
H1:subset l l' = true
H4:subset l' l = true
negb o' ||| o' = true
l:tree
o:bool
r, l':tree
o':bool
r':tree
H2:subset r r' = true
H3:subset r' r = true
H1:negb o ||| o' = true
H4:subset l l' = true
H:negb o' ||| o = true
H5:subset l' l = true
o = o'
       destruct o'; reflexivity.l, r, l':tree
o':bool
r':tree
H0:subset r r' = true
H3:subset r' r = true
H1:subset l l' = true
H4:subset l' l = true
negb o' ||| o' = true
l:tree
o:bool
r, l':tree
o':bool
r':tree
H2:subset r r' = true
H3:subset r' r = true
H1:negb o ||| o' = true
H4:subset l l' = true
H:negb o' ||| o = true
H5:subset l' l = true
o = o'
       destruct o'; reflexivity.l:tree
o:bool
r, l':tree
o':bool
r':tree
H2:subset r r' = true
H3:subset r' r = true
H1:negb o ||| o' = true
H4:subset l l' = true
H:negb o' ||| o = true
H5:subset l' l = true
o = o'
       destruct o; auto.l, r, l':tree
o':bool
r':tree
H2:subset r r' = true
H3:subset r' r = true
H1:negb false ||| o' = true
H4:subset l l' = true
H:negb o' ||| false = true
H5:subset l' l = true
false = o' destruct o'; trivial.
  Qed.

  Lemma equal_spec: forall s s', Equal s s' <-> equal s s' = true.forall s s' : t, s [=] s' <-> equal s s' = true
  Proof.forall s s' : t, s [=] s' <-> equal s s' = true
    intros.s, s':t
s [=] s' <-> equal s s' = true rewrite equal_subset.s, s':t
s [=] s' <-> subset s s' && subset s' s = true rewrite andb_true_iff.s, s':t
s [=] s' <-> subset s s' = true /\ subset s' s = true
    rewrite <- 2subset_spec.s, s':t
s [=] s' <-> s [<=] s' /\ s' [<=] s unfold Equal, Subset.s, s':t
(forall a : elt, In a s <-> In a s') <->
(forall a : elt, In a s -> In a s') /\
(forall a : elt, In a s' -> In a s) firstorder.
  Qed.

  Lemma equal_1: forall s s', Equal s s' -> equal s s' = true.forall s s' : t, s [=] s' -> equal s s' = true
  Proof.forall s s' : t, s [=] s' -> equal s s' = true intros s s'.s, s':t
s [=] s' -> equal s s' = true apply -> equal_spec; trivial. Qed.

  Lemma equal_2: forall s s', equal s s' = true -> Equal s s'.forall s s' : t, equal s s' = true -> s [=] s'
  Proof.forall s s' : t, equal s s' = true -> s [=] s' intros s s'.s, s':t
equal s s' = true -> s [=] s' apply <- equal_spec; trivial. Qed.

  Lemma eq_dec : forall s s', { eq s s' } + { ~ eq s s' }.forall s s' : t, {eq s s'} + {~ eq s s'}
  Proof.forall s s' : t, {eq s s'} + {~ eq s s'}
    unfold eq.forall s s' : t, {s [=] s'} + {~ s [=] s'}
    intros.s, s':t
{s [=] s'} + {~ s [=] s'} case_eq (equal s s'); intro H.s, s':t
H:equal s s' = true
{s [=] s'} + {~ s [=] s'}
s, s':t
H:equal s s' = false
{s [=] s'} + {~ s [=] s'}
     left.s, s':t
H:equal s s' = true
s [=] s'
s, s':t
H:equal s s' = false
{s [=] s'} + {~ s [=] s'} apply equal_2, H.s, s':t
H:equal s s' = false
{s [=] s'} + {~ s [=] s'}
     right.s, s':t
H:equal s s' = false
~ s [=] s' abstract (intro H'; rewrite (equal_1 H') in H; discriminate).
  Defined.

(Specified) definition of compare

  Lemma lex_Opp: forall u v u' v', u = CompOpp u' -> v = CompOpp v' ->
    lex u v = CompOpp (lex u' v').forall u v u' v' : comparison,
u = CompOpp u' ->
v = CompOpp v' -> lex u v = CompOpp (lex u' v')
  Proof.forall u v u' v' : comparison,
u = CompOpp u' ->
v = CompOpp v' -> lex u v = CompOpp (lex u' v') intros ? ? u' ? -> ->.u', v':comparison
lex (CompOpp u') (CompOpp v') = CompOpp (lex u' v') case u'; reflexivity. Qed.

  Lemma compare_bool_inv: forall b b',
    compare_bool b b' = CompOpp (compare_bool b' b).forall b b' : bool,
compare_bool b b' = CompOpp (compare_bool b' b)
  Proof.forall b b' : bool,
compare_bool b b' = CompOpp (compare_bool b' b) intros [|] [|]; reflexivity. Qed.

  Lemma compare_inv: forall s s', compare_fun s s' = CompOpp (compare_fun s' s).forall s s' : t,
compare_fun s s' = CompOpp (compare_fun s' s)
  Proof.forall s s' : t,
compare_fun s s' = CompOpp (compare_fun s' s)
    induction s as [|l IHl o r IHr]; destruct s' as [|l' o' r']; trivial.l':tree
o':bool
r':tree
compare_fun Leaf (Node l' o' r') =
CompOpp (compare_fun (Node l' o' r') Leaf)
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
compare_fun (Node l o r) Leaf =
CompOpp (compare_fun Leaf (Node l o r))
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') =
CompOpp (compare_fun (Node l' o' r') (Node l o r))
    unfold compare_fun.l':tree
o':bool
r':tree
(if is_empty (Node l' o' r') then Eq else Lt) =
CompOpp (if is_empty (Node l' o' r') then Eq else Gt)
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
compare_fun (Node l o r) Leaf =
CompOpp (compare_fun Leaf (Node l o r))
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') =
CompOpp (compare_fun (Node l' o' r') (Node l o r)) case is_empty; reflexivity.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
compare_fun (Node l o r) Leaf =
CompOpp (compare_fun Leaf (Node l o r))
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') =
CompOpp (compare_fun (Node l' o' r') (Node l o r))
    unfold compare_fun.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
(if is_empty (Node l o r) then Eq else Gt) =
CompOpp (if is_empty (Node l o r) then Eq else Lt)
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') =
CompOpp (compare_fun (Node l' o' r') (Node l o r)) case is_empty; reflexivity.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') =
CompOpp (compare_fun (Node l' o' r') (Node l o r))
    simpl.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare_fun l l') (compare_fun r r')) =
CompOpp
  (lex (compare_bool o' o)
     (lex (compare_fun l' l) (compare_fun r' r))) rewrite compare_bool_inv.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = CompOpp (compare_fun s' l)
IHr:forall s' : t, compare_fun r s' = CompOpp (compare_fun s' r)
l':tree
o':bool
r':tree
lex (CompOpp (compare_bool o' o))
  (lex (compare_fun l l') (compare_fun r r')) =
CompOpp
  (lex (compare_bool o' o)
     (lex (compare_fun l' l) (compare_fun r' r)))
     case compare_bool; simpl; trivial; apply lex_Opp; auto.
  Qed.

  Lemma lex_Eq: forall u v, lex u v = Eq <-> u=Eq /\ v=Eq.forall u v : comparison,
lex u v = Eq <-> u = Eq /\ v = Eq
  Proof.forall u v : comparison,
lex u v = Eq <-> u = Eq /\ v = Eq intros u v; destruct u; intuition discriminate. Qed.

  Lemma compare_bool_Eq: forall b1 b2,
    compare_bool b1 b2 = Eq <-> eqb b1 b2 = true.forall b1 b2 : bool,
compare_bool b1 b2 = Eq <-> eqb b1 b2 = true
  Proof.forall b1 b2 : bool,
compare_bool b1 b2 = Eq <-> eqb b1 b2 = true intros [|] [|]; intuition discriminate. Qed.

  Lemma compare_equal: forall s s', compare_fun s s' = Eq <-> equal s s' = true.forall s s' : t,
compare_fun s s' = Eq <-> equal s s' = true
  Proof.forall s s' : t,
compare_fun s s' = Eq <-> equal s s' = true
    induction s as [|l IHl o r IHr]; destruct s' as [|l' o' r'].compare_fun Leaf Leaf = Eq <-> equal Leaf Leaf = true
l':tree
o':bool
r':tree
compare_fun Leaf (Node l' o' r') = Eq <->
equal Leaf (Node l' o' r') = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
compare_fun (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true
     simpl.Eq = Eq <-> true = true
l':tree
o':bool
r':tree
compare_fun Leaf (Node l' o' r') = Eq <->
equal Leaf (Node l' o' r') = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
compare_fun (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true tauto.l':tree
o':bool
r':tree
compare_fun Leaf (Node l' o' r') = Eq <->
equal Leaf (Node l' o' r') = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
compare_fun (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true
     unfold compare_fun, equal.l':tree
o':bool
r':tree
(if is_empty (Node l' o' r') then Eq else Lt) = Eq <->
is_empty (Node l' o' r') = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
compare_fun (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true case is_empty; intuition discriminate.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
compare_fun (Node l o r) Leaf = Eq <->
equal (Node l o r) Leaf = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true
     unfold compare_fun, equal.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
(if is_empty (Node l o r) then Eq else Gt) = Eq <->
is_empty (Node l o r) = true
l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true case is_empty; intuition discriminate.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
compare_fun (Node l o r) (Node l' o' r') = Eq <->
equal (Node l o r) (Node l' o' r') = true
     simpl.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare_fun l l') (compare_fun r r')) = Eq <->
eqb o o' &&& equal l l' &&& equal r r' = true rewrite <- 2andb_lazy_alt, 2andb_true_iff.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare_fun l l') (compare_fun r r')) = Eq <->
(eqb o o' = true /\ equal l l' = true) /\
equal r r' = true
     rewrite <- IHl, <- IHr, <- compare_bool_Eq.l:tree
o:bool
r:tree
IHl:forall s' : t, compare_fun l s' = Eq <-> equal l s' = true
IHr:forall s' : t, compare_fun r s' = Eq <-> equal r s' = true
l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare_fun l l') (compare_fun r r')) = Eq <->
(compare_bool o o' = Eq /\ compare_fun l l' = Eq) /\
compare_fun r r' = Eq clear IHl IHr.l:tree
o:bool
r, l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare_fun l l') (compare_fun r r')) = Eq <->
(compare_bool o o' = Eq /\ compare_fun l l' = Eq) /\
compare_fun r r' = Eq
     rewrite and_assoc.l:tree
o:bool
r, l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare_fun l l') (compare_fun r r')) = Eq <->
compare_bool o o' = Eq /\
compare_fun l l' = Eq /\ compare_fun r r' = Eq rewrite <- 2lex_Eq.l:tree
o:bool
r, l':tree
o':bool
r':tree
lex (compare_bool o o')
  (lex (compare_fun l l') (compare_fun r r')) = Eq <->
lex (compare_bool o o')
  (lex (compare_fun l l') (compare_fun r r')) = Eq reflexivity.
  Qed.


  Lemma compare_gt: forall s s', compare_fun s s' = Gt -> lt s' s.forall s s' : t, compare_fun s s' = Gt -> lt s' s
  Proof.forall s s' : t, compare_fun s s' = Gt -> lt s' s
    unfold lt.forall s s' : t,
compare_fun s s' = Gt -> compare_fun s' s = Lt intros s s'.s, s':t
compare_fun s s' = Gt -> compare_fun s' s = Lt rewrite compare_inv.s, s':t
CompOpp (compare_fun s' s) = Gt ->
compare_fun s' s = Lt
     case compare_fun; trivial; intros; discriminate.
  Qed.

  Lemma compare_eq: forall s s', compare_fun s s' = Eq -> eq s s'.forall s s' : t, compare_fun s s' = Eq -> eq s s'
  Proof.forall s s' : t, compare_fun s s' = Eq -> eq s s'
    unfold eq.forall s s' : t, compare_fun s s' = Eq -> s [=] s' intros s s'.s, s':t
compare_fun s s' = Eq -> s [=] s' rewrite compare_equal, equal_spec.s, s':t
equal s s' = true -> equal s s' = true trivial.
  Qed.

  Lemma compare : forall s s' : t, Compare lt eq s s'.forall s s' : t, Compare lt eq s s'
  Proof.forall s s' : t, Compare lt eq s s'
    intros.s, s':t
Compare lt eq s s' case_eq (compare_fun s s'); intro H.s, s':t
H:compare_fun s s' = Eq
Compare lt eq s s'
s, s':t
H:compare_fun s s' = Lt
Compare lt eq s s'
s, s':t
H:compare_fun s s' = Gt
Compare lt eq s s'
    apply EQ.s, s':t
H:compare_fun s s' = Eq
eq s s'
s, s':t
H:compare_fun s s' = Lt
Compare lt eq s s'
s, s':t
H:compare_fun s s' = Gt
Compare lt eq s s' apply compare_eq, H.s, s':t
H:compare_fun s s' = Lt
Compare lt eq s s'
s, s':t
H:compare_fun s s' = Gt
Compare lt eq s s'
    apply LT.s, s':t
H:compare_fun s s' = Lt
lt s s'
s, s':t
H:compare_fun s s' = Gt
Compare lt eq s s' assumption.s, s':t
H:compare_fun s s' = Gt
Compare lt eq s s'
    apply GT.s, s':t
H:compare_fun s s' = Gt
lt s' s apply compare_gt, H.
  Defined.

  Section lt_spec.

  Inductive ct: comparison -> comparison -> comparison -> Prop :=
  | ct_xxx: forall x, ct x  x  x
  | ct_xex: forall x, ct x  Eq x
  | ct_exx: forall x, ct Eq x  x
  | ct_glx: forall x, ct Gt Lt x
  | ct_lgx: forall x, ct Lt Gt x.

  Lemma ct_cxe: forall x, ct (CompOpp x) x Eq.forall x : comparison, ct (CompOpp x) x Eq
  Proof.forall x : comparison, ct (CompOpp x) x Eq destruct x; constructor. Qed.

  Lemma ct_xce: forall x, ct x (CompOpp x) Eq.forall x : comparison, ct x (CompOpp x) Eq
  Proof.forall x : comparison, ct x (CompOpp x) Eq destruct x; constructor. Qed.

  Lemma ct_lxl: forall x, ct Lt x Lt.forall x : comparison, ct Lt x Lt
  Proof.forall x : comparison, ct Lt x Lt destruct x; constructor. Qed.

  Lemma ct_gxg: forall x, ct Gt x Gt.forall x : comparison, ct Gt x Gt
  Proof.forall x : comparison, ct Gt x Gt destruct x; constructor. Qed.

  Lemma ct_xll: forall x, ct x Lt Lt.forall x : comparison, ct x Lt Lt
  Proof.forall x : comparison, ct x Lt Lt destruct x; constructor. Qed.

  Lemma ct_xgg: forall x, ct x Gt Gt.forall x : comparison, ct x Gt Gt
  Proof.forall x : comparison, ct x Gt Gt destruct x; constructor. Qed.

  Local Hint Constructors ct: ct.
  Local Hint Resolve ct_cxe ct_xce ct_lxl ct_xll ct_gxg ct_xgg: ct.
  Ltac ct := trivial with ct.

  Lemma ct_lex: forall u v w u' v' w',
    ct u v w -> ct u' v' w' -> ct (lex u u') (lex v v') (lex w w').forall u v w u' v' w' : comparison,
ct u v w ->
ct u' v' w' -> ct (lex u u') (lex v v') (lex w w')
  Proof.forall u v w u' v' w' : comparison,
ct u v w ->
ct u' v' w' -> ct (lex u u') (lex v v') (lex w w')
    intros u v w u' v' w' H H'.u, v, w, u', v', w':comparison
H:ct u v w
H':ct u' v' w'
ct (lex u u') (lex v v') (lex w w')
    inversion_clear H; inversion_clear H'; ct; destruct w; ct; destruct w'; ct.
  Qed.

  Lemma ct_compare_bool:
    forall a b c, ct (compare_bool a b) (compare_bool b c) (compare_bool a c).forall a b c : bool,
ct (compare_bool a b) (compare_bool b c)
  (compare_bool a c)
  Proof.forall a b c : bool,
ct (compare_bool a b) (compare_bool b c)
  (compare_bool a c)
    intros [|] [|] [|]; constructor.
  Qed.

  Lemma compare_x_Leaf: forall s,
    compare_fun s Leaf = if is_empty s then Eq else Gt.forall s : t,
compare_fun s Leaf = (if is_empty s then Eq else Gt)
  Proof.forall s : t,
compare_fun s Leaf = (if is_empty s then Eq else Gt)
    intros.s:t
compare_fun s Leaf = (if is_empty s then Eq else Gt) rewrite compare_inv.s:t
CompOpp (compare_fun Leaf s) =
(if is_empty s then Eq else Gt) simpl.s:t
CompOpp (if is_empty s then Eq else Lt) =
(if is_empty s then Eq else Gt) case (is_empty s); reflexivity.
  Qed.

  Lemma compare_empty_x: forall a, is_empty a = true ->
    forall b, compare_fun a b = if is_empty b then Eq else Lt.forall a : t,
is_empty a = true ->
forall b : t,
compare_fun a b = (if is_empty b then Eq else Lt)
  Proof.forall a : t,
is_empty a = true ->
forall b : t,
compare_fun a b = (if is_empty b then Eq else Lt)
    induction a as [|l IHl o r IHr]; trivial.l:tree
o:bool
r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
is_empty (Node l o r) = true ->
forall b : t,
compare_fun (Node l o r) b =
(if is_empty b then Eq else Lt)
    destruct o.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
is_empty (Node l true r) = true ->
forall b : t,
compare_fun (Node l true r) b =
(if is_empty b then Eq else Lt)
l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
is_empty (Node l false r) = true ->
forall b : t,
compare_fun (Node l false r) b =
(if is_empty b then Eq else Lt) intro; discriminate.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
is_empty (Node l false r) = true ->
forall b : t,
compare_fun (Node l false r) b =
(if is_empty b then Eq else Lt)
    simpl is_empty.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
is_empty l &&& is_empty r = true ->
forall b : t,
compare_fun (Node l false r) b =
(if is_empty b then Eq else Lt) rewrite <- andb_lazy_alt, andb_true_iff.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
is_empty l = true /\ is_empty r = true ->
forall b : t,
compare_fun (Node l false r) b =
(if is_empty b then Eq else Lt)
    intros [Hl Hr].l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
forall b : t,
compare_fun (Node l false r) b =
(if is_empty b then Eq else Lt)
    destruct b as [|l' [|] r']; simpl compare_fun; trivial.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
(if is_empty l &&& is_empty r then Eq else Gt) =
(if is_empty Leaf then Eq else Lt)
l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (compare_fun l l') (compare_fun r r') =
(if is_empty (Node l' false r') then Eq else Lt)
     rewrite Hl, Hr.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
Eq = (if is_empty Leaf then Eq else Lt)
l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (compare_fun l l') (compare_fun r r') =
(if is_empty (Node l' false r') then Eq else Lt) trivial.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (compare_fun l l') (compare_fun r r') =
(if is_empty (Node l' false r') then Eq else Lt)
     rewrite (IHl Hl), (IHr Hr).l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (if is_empty l' then Eq else Lt)
  (if is_empty r' then Eq else Lt) =
(if is_empty (Node l' false r') then Eq else Lt) simpl.l, r:tree
IHl:is_empty l = true ->
forall b : t, compare_fun l b = (if is_empty b then Eq else Lt)
IHr:is_empty r = true ->
forall b : t, compare_fun r b = (if is_empty b then Eq else Lt)
Hl:is_empty l = true
Hr:is_empty r = true
l', r':tree
lex (if is_empty l' then Eq else Lt)
  (if is_empty r' then Eq else Lt) =
(if is_empty l' &&& is_empty r' then Eq else Lt)
     case (is_empty l'); case (is_empty r'); trivial.
  Qed.

  Lemma compare_x_empty: forall a, is_empty a = true ->
    forall b, compare_fun b a = if is_empty b then Eq else Gt.forall a : t,
is_empty a = true ->
forall b : t,
compare_fun b a = (if is_empty b then Eq else Gt)
  Proof.forall a : t,
is_empty a = true ->
forall b : t,
compare_fun b a = (if is_empty b then Eq else Gt)
    setoid_rewrite <- compare_x_Leaf.forall a : t,
is_empty a = true ->
forall b : t, compare_fun b a = compare_fun b Leaf
    intros.a:t
H:is_empty a = true
b:t
compare_fun b a = compare_fun b Leaf rewrite 2(compare_inv b), (compare_empty_x _ H).a:t
H:is_empty a = true
b:t
CompOpp (if is_empty b then Eq else Lt) =
CompOpp (compare_fun Leaf b) reflexivity.
  Qed.

  Lemma ct_compare_fun:
    forall a b c, ct (compare_fun a b) (compare_fun b c) (compare_fun a c).forall a b c : t,
ct (compare_fun a b) (compare_fun b c)
  (compare_fun a c)
  Proof.forall a b c : t,
ct (compare_fun a b) (compare_fun b c)
  (compare_fun a c)
    induction a as [|l IHl o r IHr]; intros s' s''.s', s'':t
ct (compare_fun Leaf s') (compare_fun s' s'')
  (compare_fun Leaf s'')
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'')
     destruct s' as [|l' o' r']; destruct s'' as [|l'' o'' r'']; ct.l':tree
o':bool
r':tree
ct (compare_fun Leaf (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun Leaf Leaf)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun Leaf (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'')
      rewrite compare_inv.l':tree
o':bool
r':tree
ct (CompOpp (compare_fun (Node l' o' r') Leaf))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun Leaf Leaf)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun Leaf (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'') ct.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun Leaf (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'')
      unfold compare_fun at 1.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (if is_empty (Node l' o' r') then Eq else Lt)
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'') case_eq (is_empty (Node l' o' r')); intro H'.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = true
ct Eq (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun Leaf (Node l'' o'' r''))
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
ct Lt (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'')
       rewrite (compare_empty_x _ H').l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = true
ct Eq (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare_fun Leaf (Node l'' o'' r''))
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
ct Lt (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'') ct.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
ct Lt (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun Leaf (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'')
       unfold compare_fun at 2.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
ct Lt (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (if is_empty (Node l'' o'' r'') then Eq else Lt)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'') case_eq (is_empty (Node l'' o'' r'')); intro H''.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = true
ct Lt (compare_fun (Node l' o' r') (Node l'' o'' r''))
  Eq
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = false
ct Lt (compare_fun (Node l' o' r') (Node l'' o'' r''))
  Lt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'')
        rewrite (compare_x_empty _ H''), H'.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = true
ct Lt Gt Eq
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = false
ct Lt (compare_fun (Node l' o' r') (Node l'' o'' r''))
  Lt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'') ct.l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
H':is_empty (Node l' o' r') = false
H'':is_empty (Node l'' o'' r'') = false
ct Lt (compare_fun (Node l' o' r') (Node l'' o'' r''))
  Lt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'')
        ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
s', s'':t
ct (compare_fun (Node l o r) s') (compare_fun s' s'')
  (compare_fun (Node l o r) s'')

     destruct s' as [|l' o' r']; destruct s'' as [|l'' o'' r''].l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
ct (compare_fun (Node l o r) Leaf)
  (compare_fun Leaf Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) Leaf)
  (compare_fun Leaf (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
      ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) Leaf)
  (compare_fun Leaf (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
      unfold compare_fun at 2.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) Leaf)
  (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r'')) rewrite compare_x_Leaf.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
ct (if is_empty (Node l o r) then Eq else Gt)
  (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
      case_eq (is_empty (Node l o r)); intro H.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = true
ct Eq (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
ct Gt (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
       rewrite (compare_empty_x _ H).l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = true
ct Eq (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (if is_empty (Node l'' o'' r'') then Eq else Lt)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
ct Gt (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r'')) ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
ct Gt (if is_empty (Node l'' o'' r'') then Eq else Lt)
  (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
       case_eq (is_empty (Node l'' o'' r'')); intro H''.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = true
ct Gt Eq (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = false
ct Gt Lt (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
        rewrite (compare_x_empty _ H''), H.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = true
ct Gt Eq Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = false
ct Gt Lt (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r'')) ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l'':tree
o'':bool
r'':tree
H:is_empty (Node l o r) = false
H'':is_empty (Node l'' o'' r'') = false
ct Gt Lt (compare_fun (Node l o r) (Node l'' o'' r''))
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
        ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') Leaf)
  (compare_fun (Node l o r) Leaf)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))

      rewrite 2 compare_x_Leaf.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt)
  (if is_empty (Node l o r) then Eq else Gt)
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
      case_eq (is_empty (Node l o r)); intro H.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = true
ct (compare_fun (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt) Eq
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
ct (compare_fun (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt) Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
       rewrite compare_inv, (compare_x_empty _ H).l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = true
ct
  (CompOpp
     (if is_empty (Node l' o' r') then Eq else Gt))
  (if is_empty (Node l' o' r') then Eq else Gt) Eq
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
ct (compare_fun (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt) Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r'')) ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
ct (compare_fun (Node l o r) (Node l' o' r'))
  (if is_empty (Node l' o' r') then Eq else Gt) Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
       case_eq (is_empty (Node l' o' r')); intro H'.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = true
ct (compare_fun (Node l o r) (Node l' o' r')) Eq Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = false
ct (compare_fun (Node l o r) (Node l' o' r')) Gt Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
        rewrite (compare_x_empty _ H'), H.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = true
ct Gt Eq Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = false
ct (compare_fun (Node l o r) (Node l' o' r')) Gt Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r'')) ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r':tree
H:is_empty (Node l o r) = false
H':is_empty (Node l' o' r') = false
ct (compare_fun (Node l o r) (Node l' o' r')) Gt Gt
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))
        ct.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_fun (Node l o r) (Node l' o' r'))
  (compare_fun (Node l' o' r') (Node l'' o'' r''))
  (compare_fun (Node l o r) (Node l'' o'' r''))

      simpl compare_fun.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct
  (lex (compare_bool o o')
     (lex (compare_fun l l') (compare_fun r r')))
  (lex (compare_bool o' o'')
     (lex (compare_fun l' l'') (compare_fun r' r'')))
  (lex (compare_bool o o'')
     (lex (compare_fun l l'') (compare_fun r r''))) apply ct_lex.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (compare_bool o o') (compare_bool o' o'')
  (compare_bool o o'')
l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (lex (compare_fun l l') (compare_fun r r'))
  (lex (compare_fun l' l'') (compare_fun r' r''))
  (lex (compare_fun l l'') (compare_fun r r'')) apply ct_compare_bool.l:tree
o:bool
r:tree
IHl:forall b c : t, ct (compare_fun l b) (compare_fun b c) (compare_fun l c)
IHr:forall b c : t, ct (compare_fun r b) (compare_fun b c) (compare_fun r c)
l':tree
o':bool
r', l'':tree
o'':bool
r'':tree
ct (lex (compare_fun l l') (compare_fun r r'))
  (lex (compare_fun l' l'') (compare_fun r' r''))
  (lex (compare_fun l l'') (compare_fun r r''))
       apply ct_lex; trivial.
  Qed.

  End lt_spec.

  Lemma lt_trans: forall s s' s'', lt s s' -> lt s' s'' -> lt s s''.forall s s' s'' : t, lt s s' -> lt s' s'' -> lt s s''
  Proof.forall s s' s'' : t, lt s s' -> lt s' s'' -> lt s s''
    unfold lt.forall s s' s'' : t,
compare_fun s s' = Lt ->
compare_fun s' s'' = Lt -> compare_fun s s'' = Lt intros a b c.a, b, c:t
compare_fun a b = Lt ->
compare_fun b c = Lt -> compare_fun a c = Lt assert (H := ct_compare_fun a b c).a, b, c:t
H:ct (compare_fun a b) (compare_fun b c)
  (compare_fun a c)
compare_fun a b = Lt ->
compare_fun b c = Lt -> compare_fun a c = Lt
    inversion_clear H; trivial; intros; discriminate.
  Qed.

  Lemma lt_not_eq: forall s s', lt s s' -> ~ eq s s'.forall s s' : t, lt s s' -> ~ eq s s'
  Proof.forall s s' : t, lt s s' -> ~ eq s s'
    unfold lt, eq.forall s s' : t, compare_fun s s' = Lt -> ~ s [=] s' intros s s' H H'.s, s':t
H:compare_fun s s' = Lt
H':s [=] s'
False
     rewrite equal_spec, <- compare_equal in H'.s, s':t
H:compare_fun s s' = Lt
H':compare_fun s s' = Eq
False congruence.
  Qed.

Specification of add

  Lemma add_spec: forall x y s, In y (add x s) <-> x=y \/ In y s.forall (x y : elt) (s : t),
In y (add x s) <-> x = y \/ In y s
  Proof.forall (x y : elt) (s : t),
In y (add x s) <-> x = y \/ In y s
    unfold In.forall (x y : elt) (s : t),
mem y (add x s) = true <-> x = y \/ mem y s = true induction x; intros [y|y|] [|l o r]; simpl mem;
    try (rewrite IHx; clear IHx); rewrite ?mem_Leaf; intuition congruence.
  Qed.

  Lemma add_1: forall s x y, x = y -> In y (add x s).forall (s : t) (x y : elt), x = y -> In y (add x s)
  Proof.forall (s : t) (x y : elt), x = y -> In y (add x s) intros.s:t
x, y:elt
H:x = y
In y (add x s) apply <- add_spec.s:t
x, y:elt
H:x = y
x = y \/ In y s left.s:t
x, y:elt
H:x = y
x = y assumption. Qed.

  Lemma add_2: forall s x y, In y s -> In y (add x s).forall (s : t) (x y : elt), In y s -> In y (add x s)
  Proof.forall (s : t) (x y : elt), In y s -> In y (add x s) intros.s:t
x, y:elt
H:In y s
In y (add x s) apply <- add_spec.s:t
x, y:elt
H:In y s
x = y \/ In y s right.s:t
x, y:elt
H:In y s
In y s assumption. Qed.

  Lemma add_3: forall s x y, x<>y -> In y (add x s) -> In y s.forall (s : t) (x y : elt),
x <> y -> In y (add x s) -> In y s
  Proof.forall (s : t) (x y : elt),
x <> y -> In y (add x s) -> In y s
    intros s x y H.s:t
x, y:elt
H:x <> y
In y (add x s) -> In y s rewrite add_spec.s:t
x, y:elt
H:x <> y
x = y \/ In y s -> In y s intros [->|?]; trivial.s:t
y:elt
H:y <> y
In y s elim H; trivial.
  Qed.

Specification of remove

  Lemma remove_spec: forall x y s, In y (remove x s) <-> x<>y /\ In y s.forall (x y : elt) (s : t),
In y (remove x s) <-> x <> y /\ In y s
  Proof.forall (x y : elt) (s : t),
In y (remove x s) <-> x <> y /\ In y s
    unfold In.forall (x y : elt) (s : t),
mem y (remove x s) = true <-> x <> y /\ mem y s = true
    induction x; intros [y|y|] [|l o r]; simpl remove; rewrite ?mem_node;
     simpl mem; try (rewrite IHx; clear IHx); rewrite ?mem_Leaf;
     intuition congruence.
  Qed.

  Lemma remove_1: forall s x y, x=y -> ~ In y (remove x s).forall (s : t) (x y : elt),
x = y -> ~ In y (remove x s)
  Proof.forall (s : t) (x y : elt),
x = y -> ~ In y (remove x s) intros.s:t
x, y:elt
H:x = y
~ In y (remove x s) rewrite remove_spec.s:t
x, y:elt
H:x = y
~ (x <> y /\ In y s) tauto. Qed.

  Lemma remove_2: forall s x y, x<>y -> In y s -> In y (remove x s).forall (s : t) (x y : elt),
x <> y -> In y s -> In y (remove x s)
  Proof.forall (s : t) (x y : elt),
x <> y -> In y s -> In y (remove x s) intros.s:t
x, y:elt
H:x <> y
H0:In y s
In y (remove x s) rewrite remove_spec.s:t
x, y:elt
H:x <> y
H0:In y s
x <> y /\ In y s split; assumption. Qed.

  Lemma remove_3: forall s x y, In y (remove x s) -> In y s.forall (s : t) (x y : elt),
In y (remove x s) -> In y s
  Proof.forall (s : t) (x y : elt),
In y (remove x s) -> In y s intros s x y.s:t
x, y:elt
In y (remove x s) -> In y s rewrite remove_spec.s:t
x, y:elt
x <> y /\ In y s -> In y s tauto. Qed.

Specification of singleton

  Lemma singleton_1: forall x y, In y (singleton x) -> x=y.forall x y : elt, In y (singleton x) -> x = y
  Proof.forall x y : elt, In y (singleton x) -> x = y
    unfold singleton.forall x y : elt, In y (add x empty) -> x = y intros x y.x, y:elt
In y (add x empty) -> x = y rewrite add_spec.x, y:elt
x = y \/ In y empty -> x = y
    unfold In.x, y:elt
x = y \/ mem y empty = true -> x = y rewrite mem_Leaf.x, y:elt
x = y \/ false = true -> x = y intuition discriminate.
  Qed.

  Lemma singleton_2: forall x y, x = y -> In y (singleton x).forall x y : elt, x = y -> In y (singleton x)
  Proof.forall x y : elt, x = y -> In y (singleton x)
    unfold singleton.forall x y : elt, x = y -> In y (add x empty) intros.x, y:elt
H:x = y
In y (add x empty) apply add_1.x, y:elt
H:x = y
x = y assumption.
  Qed.

Specification of union

  Lemma union_spec: forall x s s', In x (union s s') <-> In x s \/ In x s'.forall (x : elt) (s s' : t),
In x (union s s') <-> In x s \/ In x s'
  Proof.forall (x : elt) (s s' : t),
In x (union s s') <-> In x s \/ In x s'
    unfold In.forall (x : elt) (s s' : t),
mem x (union s s') = true <->
mem x s = true \/ mem x s' = true
    induction x; destruct s; destruct s'; simpl union; simpl mem;
      try (rewrite IHx; clear IHx); try intuition congruence.s1:tree
b:bool
s2, s'1:tree
b0:bool
s'2:tree
b || b0 = true <-> b = true \/ b0 = true
      apply orb_true_iff.
  Qed.

  Lemma union_1: forall s s' x, In x (union s s') -> In x s \/ In x s'.forall (s s' : t) (x : elt),
In x (union s s') -> In x s \/ In x s'
  Proof.forall (s s' : t) (x : elt),
In x (union s s') -> In x s \/ In x s' intros.s, s':t
x:elt
H:In x (union s s')
In x s \/ In x s' apply -> union_spec.s, s':t
x:elt
H:In x (union s s')
In x (union s s') assumption. Qed.

  Lemma union_2: forall s s' x, In x s -> In x (union s s').forall (s s' : t) (x : elt),
In x s -> In x (union s s')
  Proof.forall (s s' : t) (x : elt),
In x s -> In x (union s s') intros.s, s':t
x:elt
H:In x s
In x (union s s') apply <- union_spec.s, s':t
x:elt
H:In x s
In x s \/ In x s' left.s, s':t
x:elt
H:In x s
In x s assumption. Qed.

  Lemma union_3: forall s s' x, In x s' -> In x (union s s').forall (s s' : t) (x : elt),
In x s' -> In x (union s s')
  Proof.forall (s s' : t) (x : elt),
In x s' -> In x (union s s') intros.s, s':t
x:elt
H:In x s'
In x (union s s') apply <- union_spec.s, s':t
x:elt
H:In x s'
In x s \/ In x s' right.s, s':t
x:elt
H:In x s'
In x s' assumption. Qed.

Specification of inter

  Lemma inter_spec: forall x s s', In x (inter s s') <-> In x s /\ In x s'.forall (x : elt) (s s' : t),
In x (inter s s') <-> In x s /\ In x s'
  Proof.forall (x : elt) (s s' : t),
In x (inter s s') <-> In x s /\ In x s'
    unfold In.forall (x : elt) (s s' : t),
mem x (inter s s') = true <->
mem x s = true /\ mem x s' = true
    induction x; destruct s; destruct s'; simpl inter; rewrite ?mem_node;
     simpl mem; try (rewrite IHx; clear IHx); try intuition congruence.s1:tree
b:bool
s2, s'1:tree
b0:bool
s'2:tree
b && b0 = true <-> b = true /\ b0 = true
     apply andb_true_iff.
  Qed.

  Lemma inter_1: forall s s' x, In x (inter s s') -> In x s.forall (s s' : t) (x : elt),
In x (inter s s') -> In x s
  Proof.forall (s s' : t) (x : elt),
In x (inter s s') -> In x s intros s s' x.s, s':t
x:elt
In x (inter s s') -> In x s rewrite inter_spec.s, s':t
x:elt
In x s /\ In x s' -> In x s tauto. Qed.

  Lemma inter_2: forall s s' x, In x (inter s s') -> In x s'.forall (s s' : t) (x : elt),
In x (inter s s') -> In x s'
  Proof.forall (s s' : t) (x : elt),
In x (inter s s') -> In x s' intros s s' x.s, s':t
x:elt
In x (inter s s') -> In x s' rewrite inter_spec.s, s':t
x:elt
In x s /\ In x s' -> In x s' tauto. Qed.

  Lemma inter_3: forall s s' x, In x s -> In x s' -> In x (inter s s').forall (s s' : t) (x : elt),
In x s -> In x s' -> In x (inter s s')
  Proof.forall (s s' : t) (x : elt),
In x s -> In x s' -> In x (inter s s') intros.s, s':t
x:elt
H:In x s
H0:In x s'
In x (inter s s') rewrite inter_spec.s, s':t
x:elt
H:In x s
H0:In x s'
In x s /\ In x s' split; assumption. Qed.

Specification of diff

  Lemma diff_spec: forall x s s', In x (diff s s') <-> In x s /\ ~ In x s'.forall (x : elt) (s s' : t),
In x (diff s s') <-> In x s /\ ~ In x s'
  Proof.forall (x : elt) (s s' : t),
In x (diff s s') <-> In x s /\ ~ In x s'
    unfold In.forall (x : elt) (s s' : t),
mem x (diff s s') = true <->
mem x s = true /\ mem x s' <> true
    induction x; destruct s; destruct s' as [|l' o' r']; simpl diff;
     rewrite ?mem_node; simpl mem;
      try (rewrite IHx; clear IHx); try intuition congruence.s1:tree
b:bool
s2, l':tree
o':bool
r':tree
b && negb o' = true <-> b = true /\ o' <> true
      rewrite andb_true_iff.s1:tree
b:bool
s2, l':tree
o':bool
r':tree
b = true /\ negb o' = true <-> b = true /\ o' <> true destruct o'; intuition discriminate.
  Qed.

  Lemma diff_1: forall s s' x, In x (diff s s') -> In x s.forall (s s' : t) (x : elt),
In x (diff s s') -> In x s
  Proof.forall (s s' : t) (x : elt),
In x (diff s s') -> In x s intros s s' x.s, s':t
x:elt
In x (diff s s') -> In x s rewrite diff_spec.s, s':t
x:elt
In x s /\ ~ In x s' -> In x s tauto. Qed.

  Lemma diff_2: forall s s' x, In x (diff s s') -> ~ In x s'.forall (s s' : t) (x : elt),
In x (diff s s') -> ~ In x s'
  Proof.forall (s s' : t) (x : elt),
In x (diff s s') -> ~ In x s' intros s s' x.s, s':t
x:elt
In x (diff s s') -> ~ In x s' rewrite diff_spec.s, s':t
x:elt
In x s /\ ~ In x s' -> ~ In x s' tauto. Qed.

  Lemma diff_3: forall s s' x, In x s -> ~ In x s' -> In x (diff s s').forall (s s' : t) (x : elt),
In x s -> ~ In x s' -> In x (diff s s')
  Proof.forall (s s' : t) (x : elt),
In x s -> ~ In x s' -> In x (diff s s') intros.s, s':t
x:elt
H:In x s
H0:~ In x s'
In x (diff s s') rewrite diff_spec.s, s':t
x:elt
H:In x s
H0:~ In x s'
In x s /\ ~ In x s' split; assumption. Qed.

Specification of fold

  Lemma fold_1: forall s (A : Type) (i : A) (f : elt -> A -> A),
      fold f s i = fold_left (fun a e => f e a) (elements s) i.forall (s : t) (A : Type) (i : A) (f : elt -> A -> A),
fold f s i =
fold_left (fun (a : A) (e : elt) => f e a)
  (elements s) i
  Proof.forall (s : t) (A : Type) (i : A) (f : elt -> A -> A),
fold f s i =
fold_left (fun (a : A) (e : elt) => f e a)
  (elements s) i
    unfold fold, elements.forall (s : t) (A : Type) (i : A) (f : elt -> A -> A),
xfold f s i 1 =
fold_left (fun (a : A) (e : elt) => f e a)
  (xelements s 1 nil) i intros s A i f.s:t
A:Type
i:A
f:elt -> A -> A
xfold f s i 1 =
fold_left (fun (a : A) (e : elt) => f e a)
  (xelements s 1 nil) i revert s i.A:Type
f:elt -> A -> A
forall (s : t) (i : A),
xfold f s i 1 =
fold_left (fun (a : A) (e : elt) => f e a)
  (xelements s 1 nil) i
    set (f' := fun a e => f e a).A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i
    assert (H: forall s i j acc,
      fold_left f' acc (xfold f s i j) =
      fold_left f' (xelements s j acc) i).A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
forall (s : t) (i : A) (j : elt) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : elt) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i

    induction s as [|l IHl o r IHr]; intros; trivial.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l:tree
o:bool
r:tree
IHl:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:elt
acc:list elt
fold_left f' acc (xfold f (Node l o r) i j) =
fold_left f' (xelements (Node l o r) j acc) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : elt) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i
      destruct o; simpl xelements; simpl xfold.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:elt
acc:list elt
fold_left f' acc
  (xfold f r (f (rev j) (xfold f l i j~0)) j~1) =
fold_left f'
  (xelements l j~0 (rev j :: xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:elt
acc:list elt
fold_left f' acc (xfold f r (xfold f l i j~0) j~1) =
fold_left f' (xelements l j~0 (xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : elt) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i
        rewrite IHr, <- IHl.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:elt
acc:list elt
fold_left f' (xelements r j~1 acc)
  (f (rev j) (xfold f l i j~0)) =
fold_left f' (rev j :: xelements r j~1 acc)
  (xfold f l i j~0)
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:elt
acc:list elt
fold_left f' acc (xfold f r (xfold f l i j~0) j~1) =
fold_left f' (xelements l j~0 (xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : elt) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i reflexivity.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:elt
acc:list elt
fold_left f' acc (xfold f r (xfold f l i j~0) j~1) =
fold_left f' (xelements l j~0 (xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : elt) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i
        rewrite IHr.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
l, r:tree
IHl:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f l i0 j0) = fold_left f' (xelements l j0 acc0) i0
IHr:forall (i0 : A) (j0 : elt) (acc0 : list elt),
fold_left f' acc0 (xfold f r i0 j0) = fold_left f' (xelements r j0 acc0) i0
i:A
j:elt
acc:list elt
fold_left f' (xelements r j~1 acc) (xfold f l i j~0) =
fold_left f' (xelements l j~0 (xelements r j~1 acc)) i
A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : elt) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i apply IHl.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s : t) (i : A) (j : elt) (acc : list elt),
fold_left f' acc (xfold f s i j) =
fold_left f' (xelements s j acc) i
forall (s : t) (i : A),
xfold f s i 1 = fold_left f' (xelements s 1 nil) i

    intros.A:Type
f:elt -> A -> A
f':=fun (a : A) (e : elt) => f e a:A -> elt -> A
H:forall (s0 : t) (i0 : A) (j : elt)
  (acc : list elt),
fold_left f' acc (xfold f s0 i0 j) =
fold_left f' (xelements s0 j acc) i0
s:t
i:A
xfold f s i 1 = fold_left f' (xelements s 1 nil) i exact (H s i 1 nil).
  Qed.

Specification of cardinal

  Lemma cardinal_1: forall s, cardinal s = length (elements s).forall s : t, cardinal s = length (elements s)
  Proof.forall s : t, cardinal s = length (elements s)
    unfold elements.forall s : t, cardinal s = length (xelements s 1 nil)
    assert (H: forall s j acc,
                (cardinal s + length acc)%nat = length (xelements s j acc)).forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)

    induction s as [|l IHl b r IHr]; intros j acc; simpl; trivial.l:tree
b:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
((if b
  then S (cardinal l + cardinal r)
  else cardinal l + cardinal r) + length acc)%nat =
length
  (if b
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) destruct b.l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(S (cardinal l + cardinal r) + length acc)%nat =
length
  (xelements l j~0 (rev j :: xelements r j~1 acc))
l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)
      rewrite <- IHl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(S (cardinal l + cardinal r) + length acc)%nat =
(cardinal l + length (rev j :: xelements r j~1 acc))%nat
l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
S (cardinal l + cardinal r + length acc) =
(cardinal l + S (length (xelements r j~1 acc)))%nat
l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) rewrite <- IHr.l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
S (cardinal l + cardinal r + length acc) =
(cardinal l + S (cardinal r + length acc))%nat
l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)
       rewrite <- plus_n_Sm, Plus.plus_assoc.l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
S (cardinal l + cardinal r + length acc) =
S (cardinal l + cardinal r + length acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) reflexivity.l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(cardinal l + cardinal r + length acc)%nat =
length (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)
      rewrite <- IHl, <- IHr.l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(cardinal l + cardinal r + length acc)%nat =
(cardinal l + (cardinal r + length acc))%nat
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) rewrite Plus.plus_assoc.l, r:tree
IHl:forall (j0 : elt) (acc0 : list elt),
(cardinal l + length acc0)%nat = length (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list elt),
(cardinal r + length acc0)%nat = length (xelements r j0 acc0)
j:elt
acc:list elt
(cardinal l + cardinal r + length acc)%nat =
(cardinal l + cardinal r + length acc)%nat
H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil) reflexivity.H:forall (s : t) (j : elt) (acc : list elt),
(cardinal s + length acc)%nat =
length (xelements s j acc)
forall s : t, cardinal s = length (xelements s 1 nil)

    intros.H:forall (s0 : t) (j : elt) (acc : list elt),
(cardinal s0 + length acc)%nat =
length (xelements s0 j acc)
s:t
cardinal s = length (xelements s 1 nil) rewrite <- H.H:forall (s0 : t) (j : elt) (acc : list elt),
(cardinal s0 + length acc)%nat =
length (xelements s0 j acc)
s:t
cardinal s = (cardinal s + length nil)%nat simpl.H:forall (s0 : t) (j : elt) (acc : list elt),
(cardinal s0 + length acc)%nat =
length (xelements s0 j acc)
s:t
cardinal s = (cardinal s + 0)%nat rewrite Plus.plus_comm.H:forall (s0 : t) (j : elt) (acc : list elt),
(cardinal s0 + length acc)%nat =
length (xelements s0 j acc)
s:t
cardinal s = (0 + cardinal s)%nat reflexivity.
  Qed.

Specification of filter

  Lemma xfilter_spec: forall f s x i,
    In x (xfilter f s i) <-> In x s /\ f (i@x) = true.forall (f : elt -> bool) (s : t) (x i : elt),
In x (xfilter f s i) <-> In x s /\ f (i @ x) = true
  Proof.forall (f : elt -> bool) (s : t) (x i : elt),
In x (xfilter f s i) <-> In x s /\ f (i @ x) = true
    intro f.f:elt -> bool
forall (s : t) (x i : elt),
In x (xfilter f s i) <-> In x s /\ f (i @ x) = true unfold In.f:elt -> bool
forall (s : t) (x i : elt),
mem x (xfilter f s i) = true <->
mem x s = true /\ f (i @ x) = true
    induction s as [|l IHl o r IHr]; intros x i; simpl xfilter.f:elt -> bool
x, i:elt
mem x Leaf = true <->
mem x Leaf = true /\ f (i @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:elt
mem x
  (node (xfilter f l i~0) (o &&& f (rev i))
     (xfilter f r i~1)) = true <->
mem x (Node l o r) = true /\ f (i @ x) = true
     rewrite mem_Leaf.f:elt -> bool
x, i:elt
false = true <-> false = true /\ f (i @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:elt
mem x
  (node (xfilter f l i~0) (o &&& f (rev i))
     (xfilter f r i~1)) = true <->
mem x (Node l o r) = true /\ f (i @ x) = true intuition discriminate.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:elt
mem x
  (node (xfilter f l i~0) (o &&& f (rev i))
     (xfilter f r i~1)) = true <->
mem x (Node l o r) = true /\ f (i @ x) = true
     rewrite mem_node.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x, i:elt
mem x
  (Node (xfilter f l i~0) (o &&& f (rev i))
     (xfilter f r i~1)) = true <->
mem x (Node l o r) = true /\ f (i @ x) = true destruct x; simpl.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x:positive
i:elt
mem x (xfilter f r i~1) = true <->
mem x r = true /\ f (i @ x~1) = true
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x:positive
i:elt
mem x (xfilter f l i~0) = true <->
mem x l = true /\ f (i @ x~0) = true
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : elt,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : elt,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:elt
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true
       rewrite IHr.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x:positive
i:elt
mem x r = true /\ f (i~1 @ x) = true <->
mem x r = true /\ f (i @ x~1) = true
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x:positive
i:elt
mem x (xfilter f l i~0) = true <->
mem x l = true /\ f (i @ x~0) = true
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : elt,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : elt,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:elt
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true reflexivity.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x:positive
i:elt
mem x (xfilter f l i~0) = true <->
mem x l = true /\ f (i @ x~0) = true
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : elt,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : elt,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:elt
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true
       rewrite IHl.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x0 i0 : elt,
mem x0 (xfilter f l i0) = true <-> mem x0 l = true /\ f (i0 @ x0) = true
IHr:forall x0 i0 : elt,
mem x0 (xfilter f r i0) = true <-> mem x0 r = true /\ f (i0 @ x0) = true
x:positive
i:elt
mem x l = true /\ f (i~0 @ x) = true <->
mem x l = true /\ f (i @ x~0) = true
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : elt,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : elt,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:elt
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true reflexivity.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : elt,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : elt,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:elt
o &&& f (rev i) = true <->
o = true /\ f (i @ 1) = true
       rewrite <- andb_lazy_alt.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall x i0 : elt,
mem x (xfilter f l i0) = true <-> mem x l = true /\ f (i0 @ x) = true
IHr:forall x i0 : elt,
mem x (xfilter f r i0) = true <-> mem x r = true /\ f (i0 @ x) = true
i:elt
o && f (rev i) = true <-> o = true /\ f (i @ 1) = true apply andb_true_iff.
  Qed.

  Lemma filter_1 : forall s x f, @compat_bool elt E.eq f ->
    In x (filter f s) -> In x s.forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f -> In x (filter f s) -> In x s
  Proof.forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f -> In x (filter f s) -> In x s unfold filter.forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f -> In x (xfilter f s 1) -> In x s intros s x f _.s:t
x:elt
f:elt -> bool
In x (xfilter f s 1) -> In x s rewrite xfilter_spec.s:t
x:elt
f:elt -> bool
In x s /\ f (1 @ x) = true -> In x s tauto. Qed.

  Lemma filter_2 : forall s x f, @compat_bool elt E.eq f ->
    In x (filter f s) -> f x = true.forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f -> In x (filter f s) -> f x = true
  Proof.forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f -> In x (filter f s) -> f x = true unfold filter.forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f ->
In x (xfilter f s 1) -> f x = true intros s x f _.s:t
x:elt
f:elt -> bool
In x (xfilter f s 1) -> f x = true rewrite xfilter_spec.s:t
x:elt
f:elt -> bool
In x s /\ f (1 @ x) = true -> f x = true tauto. Qed.

  Lemma filter_3 : forall s x f, @compat_bool elt E.eq f -> In x s ->
    f x = true -> In x (filter f s).forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f ->
In x s -> f x = true -> In x (filter f s)
  Proof.forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f ->
In x s -> f x = true -> In x (filter f s) unfold filter.forall (s : t) (x : elt) (f : elt -> bool),
compat_bool E.eq f ->
In x s -> f x = true -> In x (xfilter f s 1) intros s x f _.s:t
x:elt
f:elt -> bool
In x s -> f x = true -> In x (xfilter f s 1) rewrite xfilter_spec.s:t
x:elt
f:elt -> bool
In x s -> f x = true -> In x s /\ f (1 @ x) = true tauto. Qed.

Specification of for_all

  Lemma xforall_spec: forall f s i,
    xforall f s i = true <-> For_all (fun x => f (i@x) = true) s.forall (f : elt -> bool) (s : t) (i : elt),
xforall f s i = true <->
For_all (fun x : elt => f (i @ x) = true) s
  Proof.forall (f : elt -> bool) (s : t) (i : elt),
xforall f s i = true <->
For_all (fun x : elt => f (i @ x) = true) s
    unfold For_all, In.forall (f : elt -> bool) (s : t) (i : elt),
xforall f s i = true <->
(forall x : elt, mem x s = true -> f (i @ x) = true) intro f.f:elt -> bool
forall (s : t) (i : elt),
xforall f s i = true <->
(forall x : elt, mem x s = true -> f (i @ x) = true)
    induction s as [|l IHl o r IHr]; intros i; simpl.f:elt -> bool
i:elt
true = true <->
(forall x : elt, false = true -> f (i @ x) = true)
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : elt,
xforall f l i0 = true <->
(forall x : elt, mem x l = true -> f (i0 @ x) = true)
IHr:forall i0 : elt,
xforall f r i0 = true <->
(forall x : elt, mem x r = true -> f (i0 @ x) = true)
i:elt
(negb o ||| f (rev i)) &&& xforall f r i~1 &&&
xforall f l i~0 = true <->
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) now split.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : elt,
xforall f l i0 = true <->
(forall x : elt, mem x l = true -> f (i0 @ x) = true)
IHr:forall i0 : elt,
xforall f r i0 = true <->
(forall x : elt, mem x r = true -> f (i0 @ x) = true)
i:elt
(negb o ||| f (rev i)) &&& xforall f r i~1 &&&
xforall f l i~0 = true <->
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true)
     rewrite <- 2andb_lazy_alt, <- orb_lazy_alt, 2 andb_true_iff.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : elt,
xforall f l i0 = true <->
(forall x : elt, mem x l = true -> f (i0 @ x) = true)
IHr:forall i0 : elt,
xforall f r i0 = true <->
(forall x : elt, mem x r = true -> f (i0 @ x) = true)
i:elt
(negb o || f (rev i) = true /\ xforall f r i~1 = true) /\
xforall f l i~0 = true <->
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true)
     rewrite IHl, IHr.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : elt,
xforall f l i0 = true <->
(forall x : elt, mem x l = true -> f (i0 @ x) = true)
IHr:forall i0 : elt,
xforall f r i0 = true <->
(forall x : elt, mem x r = true -> f (i0 @ x) = true)
i:elt
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true) <->
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) clear IHl IHr.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true) <->
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true)
      split.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true) ->
forall x : elt,
match x with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true)
       intros [[Hi Hr] Hl] x.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:negb o || f (rev i) = true
Hr:forall x0 : elt,
mem x0 r = true -> f (i~1 @ x0) = true
Hl:forall x0 : elt,
mem x0 l = true -> f (i~0 @ x0) = true
x:elt
match x with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true) destruct x; simpl; intro H.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:negb o || f (rev i) = true
Hr:forall x0 : elt,
mem x0 r = true -> f (i~1 @ x0) = true
Hl:forall x0 : elt,
mem x0 l = true -> f (i~0 @ x0) = true
x:positive
H:mem x r = true
f (i @ x~1) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:negb o || f (rev i) = true
Hr:forall x0 : elt,
mem x0 r = true -> f (i~1 @ x0) = true
Hl:forall x0 : elt,
mem x0 l = true -> f (i~0 @ x0) = true
x:positive
H:mem x l = true
f (i @ x~0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:negb o || f (rev i) = true
Hr:forall x : elt,
mem x r = true -> f (i~1 @ x) = true
Hl:forall x : elt,
mem x l = true -> f (i~0 @ x) = true
H:o = true
f (i @ 1) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true)
        apply Hr, H.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:negb o || f (rev i) = true
Hr:forall x0 : elt,
mem x0 r = true -> f (i~1 @ x0) = true
Hl:forall x0 : elt,
mem x0 l = true -> f (i~0 @ x0) = true
x:positive
H:mem x l = true
f (i @ x~0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:negb o || f (rev i) = true
Hr:forall x : elt,
mem x r = true -> f (i~1 @ x) = true
Hl:forall x : elt,
mem x l = true -> f (i~0 @ x) = true
H:o = true
f (i @ 1) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true)
        apply Hl, H.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:negb o || f (rev i) = true
Hr:forall x : elt,
mem x r = true -> f (i~1 @ x) = true
Hl:forall x : elt,
mem x l = true -> f (i~0 @ x) = true
H:o = true
f (i @ 1) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true)
        rewrite H in Hi.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:negb true || f (rev i) = true
Hr:forall x : elt,
mem x r = true -> f (i~1 @ x) = true
Hl:forall x : elt,
mem x l = true -> f (i~0 @ x) = true
H:o = true
f (i @ 1) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true) assumption.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(forall x : elt,
 match x with
 | i0~1 => mem i0 r
 | i0~0 => mem i0 l
 | 1 => o
 end = true -> f (i @ x) = true) ->
(negb o || f (rev i) = true /\
 (forall x : elt, mem x r = true -> f (i~1 @ x) = true)) /\
(forall x : elt, mem x l = true -> f (i~0 @ x) = true)
       intro H; intuition.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x : elt,
match x with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x) = true
negb o || f (rev i) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x r = true
f (i~1 @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
f (i~0 @ x) = true
        specialize (H 1).f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:match 1 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ 1) = true
negb o || f (rev i) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x r = true
f (i~1 @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
f (i~0 @ x) = true destruct o.f:elt -> bool
l, r:tree
i:elt
H:true = true -> f (i @ 1) = true
negb true || f (rev i) = true
f:elt -> bool
l, r:tree
i:elt
H:false = true -> f (i @ 1) = true
negb false || f (rev i) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x r = true
f (i~1 @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
f (i~0 @ x) = true apply H.f:elt -> bool
l, r:tree
i:elt
H:true = true -> f (i @ 1) = true
true = true
f:elt -> bool
l, r:tree
i:elt
H:false = true -> f (i @ 1) = true
negb false || f (rev i) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x r = true
f (i~1 @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
f (i~0 @ x) = true reflexivity.f:elt -> bool
l, r:tree
i:elt
H:false = true -> f (i @ 1) = true
negb false || f (rev i) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x r = true
f (i~1 @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
f (i~0 @ x) = true reflexivity.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x r = true
f (i~1 @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
f (i~0 @ x) = true
        apply H.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x r = true
mem x r = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
f (i~0 @ x) = true assumption.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
f (i~0 @ x) = true
        apply H.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
H:forall x0 : elt,
match x0 with
| i0~1 => mem i0 r
| i0~0 => mem i0 l
| 1 => o
end = true -> f (i @ x0) = true
x:elt
H0:mem x l = true
mem x l = true assumption.
  Qed.

  Lemma for_all_1 : forall s f, @compat_bool elt E.eq f ->
    For_all (fun x => f x = true) s -> for_all f s = true.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
For_all (fun x : elt => f x = true) s ->
for_all f s = true
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
For_all (fun x : elt => f x = true) s ->
for_all f s = true intros s f _.s:t
f:elt -> bool
For_all (fun x : elt => f x = true) s ->
for_all f s = true unfold for_all.s:t
f:elt -> bool
For_all (fun x : elt => f x = true) s ->
xforall f s 1 = true rewrite xforall_spec.s:t
f:elt -> bool
For_all (fun x : elt => f x = true) s ->
For_all (fun x : elt => f (1 @ x) = true) s trivial. Qed.

  Lemma for_all_2 : forall s f, @compat_bool elt E.eq f ->
    for_all f s = true -> For_all (fun x => f x = true) s.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
for_all f s = true ->
For_all (fun x : elt => f x = true) s
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
for_all f s = true ->
For_all (fun x : elt => f x = true) s intros s f _.s:t
f:elt -> bool
for_all f s = true ->
For_all (fun x : elt => f x = true) s unfold for_all.s:t
f:elt -> bool
xforall f s 1 = true ->
For_all (fun x : elt => f x = true) s rewrite xforall_spec.s:t
f:elt -> bool
For_all (fun x : elt => f (1 @ x) = true) s ->
For_all (fun x : elt => f x = true) s trivial. Qed.

Specification of ∃

  Lemma xexists_spec: forall f s i,
    xexists f s i = true <-> Exists (fun x => f (i@x) = true) s.forall (f : elt -> bool) (s : t) (i : elt),
xexists f s i = true <->
Exists (fun x : elt => f (i @ x) = true) s
  Proof.forall (f : elt -> bool) (s : t) (i : elt),
xexists f s i = true <->
Exists (fun x : elt => f (i @ x) = true) s
    unfold Exists, In.forall (f : elt -> bool) (s : t) (i : elt),
xexists f s i = true <->
(exists x : elt, mem x s = true /\ f (i @ x) = true) intro f.f:elt -> bool
forall (s : t) (i : elt),
xexists f s i = true <->
(exists x : elt, mem x s = true /\ f (i @ x) = true)
    induction s as [|l IHl o r IHr]; intros i; simpl.f:elt -> bool
i:elt
false = true <->
(exists x : elt, false = true /\ f (i @ x) = true)
f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : elt,
xexists f l i0 = true <->
(exists x : elt, mem x l = true /\ f (i0 @ x) = true)
IHr:forall i0 : elt,
xexists f r i0 = true <->
(exists x : elt, mem x r = true /\ f (i0 @ x) = true)
i:elt
o &&& f (rev i) ||| xexists f r i~1
||| xexists f l i~0 = true <->
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true)
    split; [ discriminate | now intros  [ _ [? _]]].f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : elt,
xexists f l i0 = true <->
(exists x : elt, mem x l = true /\ f (i0 @ x) = true)
IHr:forall i0 : elt,
xexists f r i0 = true <->
(exists x : elt, mem x r = true /\ f (i0 @ x) = true)
i:elt
o &&& f (rev i) ||| xexists f r i~1
||| xexists f l i~0 = true <->
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true)
     rewrite <- 2orb_lazy_alt, 2orb_true_iff, <- andb_lazy_alt, andb_true_iff.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : elt,
xexists f l i0 = true <->
(exists x : elt, mem x l = true /\ f (i0 @ x) = true)
IHr:forall i0 : elt,
xexists f r i0 = true <->
(exists x : elt, mem x r = true /\ f (i0 @ x) = true)
i:elt
(o = true /\ f (rev i) = true \/
 xexists f r i~1 = true) \/ xexists f l i~0 = true <->
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true)
     rewrite IHl, IHr.f:elt -> bool
l:tree
o:bool
r:tree
IHl:forall i0 : elt,
xexists f l i0 = true <->
(exists x : elt, mem x l = true /\ f (i0 @ x) = true)
IHr:forall i0 : elt,
xexists f r i0 = true <->
(exists x : elt, mem x r = true /\ f (i0 @ x) = true)
i:elt
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true) <->
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) clear IHl IHr.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true) <->
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true)
      split.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true) ->
exists x : elt,
  match x with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true)
       intros [[Hi|[x Hr]]|[x Hl]].f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:o = true /\ f (rev i) = true
exists x : elt,
  match x with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x) = true
f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hr:mem x r = true /\ f (i~1 @ x) = true
exists x0 : elt,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : elt,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true)
        exists 1.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
Hi:o = true /\ f (rev i) = true
o = true /\ f (i @ 1) = true
f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hr:mem x r = true /\ f (i~1 @ x) = true
exists x0 : elt,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : elt,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true) exact Hi.f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hr:mem x r = true /\ f (i~1 @ x) = true
exists x0 : elt,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : elt,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true)
        exists x~1.f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hr:mem x r = true /\ f (i~1 @ x) = true
mem x r = true /\ f (i @ x~1) = true
f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : elt,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true) exact Hr.f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hl:mem x l = true /\ f (i~0 @ x) = true
exists x0 : elt,
  match x0 with
  | i0~1 => mem i0 r
  | i0~0 => mem i0 l
  | 1 => o
  end = true /\ f (i @ x0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true)
        exists x~0.f:elt -> bool
l:tree
o:bool
r:tree
i, x:elt
Hl:mem x l = true /\ f (i~0 @ x) = true
mem x l = true /\ f (i @ x~0) = true
f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true) exact Hl.f:elt -> bool
l:tree
o:bool
r:tree
i:elt
(exists x : elt,
   match x with
   | i0~1 => mem i0 r
   | i0~0 => mem i0 l
   | 1 => o
   end = true /\ f (i @ x) = true) ->
(o = true /\ f (rev i) = true \/
 (exists x : elt, mem x r = true /\ f (i~1 @ x) = true)) \/
(exists x : elt, mem x l = true /\ f (i~0 @ x) = true)
       intros [[x|x|] H]; eauto.
  Qed.

  Lemma exists_1 : forall s f, @compat_bool elt E.eq f ->
      Exists (fun x => f x = true) s -> exists_ f s = true.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
Exists (fun x : elt => f x = true) s ->
exists_ f s = true
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
Exists (fun x : elt => f x = true) s ->
exists_ f s = true intros s f _.s:t
f:elt -> bool
Exists (fun x : elt => f x = true) s ->
exists_ f s = true unfold exists_.s:t
f:elt -> bool
Exists (fun x : elt => f x = true) s ->
xexists f s 1 = true rewrite xexists_spec.s:t
f:elt -> bool
Exists (fun x : elt => f x = true) s ->
Exists (fun x : elt => f (1 @ x) = true) s trivial. Qed.

  Lemma exists_2 : forall s f, @compat_bool elt E.eq f ->
      exists_ f s = true -> Exists (fun x => f x = true) s.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
exists_ f s = true ->
Exists (fun x : elt => f x = true) s
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
exists_ f s = true ->
Exists (fun x : elt => f x = true) s intros s f _.s:t
f:elt -> bool
exists_ f s = true ->
Exists (fun x : elt => f x = true) s unfold exists_.s:t
f:elt -> bool
xexists f s 1 = true ->
Exists (fun x : elt => f x = true) s rewrite xexists_spec.s:t
f:elt -> bool
Exists (fun x : elt => f (1 @ x) = true) s ->
Exists (fun x : elt => f x = true) s trivial. Qed.

Specification of partition

  Lemma partition_filter : forall s f,
    partition f s = (filter f s, filter (fun x => negb (f x)) s).forall (s : t) (f : elt -> bool),
partition f s =
(filter f s, filter (fun x : elt => negb (f x)) s)
  Proof.forall (s : t) (f : elt -> bool),
partition f s =
(filter f s, filter (fun x : elt => negb (f x)) s)
    unfold partition, filter.forall (s : t) (f : elt -> bool),
xpartition f s 1 =
(xfilter f s 1,
xfilter (fun x : elt => negb (f x)) s 1) intros s f.s:t
f:elt -> bool
xpartition f s 1 =
(xfilter f s 1,
xfilter (fun x : elt => negb (f x)) s 1) generalize 1 as j.s:t
f:elt -> bool
forall j : positive,
xpartition f s j =
(xfilter f s j,
xfilter (fun x : elt => negb (f x)) s j)
    induction s as [|l IHl o r IHr]; intro j.f:elt -> bool
j:positive
xpartition f Leaf j =
(xfilter f Leaf j,
xfilter (fun x : elt => negb (f x)) Leaf j)
l:tree
o:bool
r:tree
f:elt -> bool
IHl:forall j0 : positive,
xpartition f l j0 =
(xfilter f l j0, xfilter (fun x : elt => negb (f x)) l j0)
IHr:forall j0 : positive,
xpartition f r j0 =
(xfilter f r j0, xfilter (fun x : elt => negb (f x)) r j0)
j:positive
xpartition f (Node l o r) j =
(xfilter f (Node l o r) j,
xfilter (fun x : elt => negb (f x)) (Node l o r) j)
      reflexivity.l:tree
o:bool
r:tree
f:elt -> bool
IHl:forall j0 : positive,
xpartition f l j0 =
(xfilter f l j0, xfilter (fun x : elt => negb (f x)) l j0)
IHr:forall j0 : positive,
xpartition f r j0 =
(xfilter f r j0, xfilter (fun x : elt => negb (f x)) r j0)
j:positive
xpartition f (Node l o r) j =
(xfilter f (Node l o r) j,
xfilter (fun x : elt => negb (f x)) (Node l o r) j)
      destruct o; simpl; rewrite IHl, IHr; reflexivity.
  Qed.

  Lemma partition_1 : forall s f, @compat_bool elt E.eq f ->
      Equal (fst (partition f s)) (filter f s).forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
fst (partition f s) [=] filter f s
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
fst (partition f s) [=] filter f s intros.s:t
f:elt -> bool
H:compat_bool E.eq f
fst (partition f s) [=] filter f s rewrite partition_filter.s:t
f:elt -> bool
H:compat_bool E.eq f
fst (filter f s, filter (fun x : elt => negb (f x)) s)
[=] filter f s apply eq_refl. Qed.

  Lemma partition_2 : forall s f, @compat_bool elt E.eq f ->
      Equal (snd (partition f s)) (filter (fun x => negb (f x)) s).forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
snd (partition f s) [=]
filter (fun x : elt => negb (f x)) s
  Proof.forall (s : t) (f : elt -> bool),
compat_bool E.eq f ->
snd (partition f s) [=]
filter (fun x : elt => negb (f x)) s intros.s:t
f:elt -> bool
H:compat_bool E.eq f
snd (partition f s) [=]
filter (fun x : elt => negb (f x)) s rewrite partition_filter.s:t
f:elt -> bool
H:compat_bool E.eq f
snd (filter f s, filter (fun x : elt => negb (f x)) s)
[=] filter (fun x : elt => negb (f x)) s apply eq_refl. Qed.

Specification of elements

  Notation InL := (InA E.eq).

  Lemma xelements_spec: forall s j acc y,
    InL y (xelements s j acc)
    <->
    InL y acc \/ exists x, y=(j@x) /\ mem x s = true.forall (s : t) (j : elt) (acc : list elt)
  (y : positive),
InL y (xelements s j acc) <->
InL y acc \/
(exists x : elt, y = j @ x /\ mem x s = true)
  Proof.forall (s : t) (j : elt) (acc : list elt)
  (y : positive),
InL y (xelements s j acc) <->
InL y acc \/
(exists x : elt, y = j @ x /\ mem x s = true)
    induction s as [|l IHl o r IHr]; simpl.forall (j : elt) (acc : list elt) (y : positive),
InL y acc <->
InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : elt) (acc : list elt) (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true)
      intros.j:elt
acc:list elt
y:positive
InL y acc <->
InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : elt) (acc : list elt) (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) split; intro H.j:elt
acc:list elt
y:positive
H:InL y acc
InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
j:elt
acc:list elt
y:positive
H:InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : elt) (acc : list elt) (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true)
        left.j:elt
acc:list elt
y:positive
H:InL y acc
InL y acc
j:elt
acc:list elt
y:positive
H:InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : elt) (acc : list elt) (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) assumption.j:elt
acc:list elt
y:positive
H:InL y acc \/
(exists x : elt, y = j @ x /\ false = true)
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : elt) (acc : list elt) (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true)
        destruct H as [H|[x [Hx Hx']]].j:elt
acc:list elt
y:positive
H:InL y acc
InL y acc
j:elt
acc:list elt
y:positive
x:elt
Hx:y = j @ x
Hx':false = true
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : elt) (acc : list elt) (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) assumption.j:elt
acc:list elt
y:positive
x:elt
Hx:y = j @ x
Hx':false = true
InL y acc
l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : elt) (acc : list elt) (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) discriminate.l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements l j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x l = true)
IHr:forall (j : elt) (acc : list elt) (y : positive),
InL y (xelements r j acc) <->
InL y acc \/ (exists x : elt, y = j @ x /\ mem x r = true)
forall (j : elt) (acc : list elt) (y : positive),
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true)

      intros j acc y.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => o
   end = true) case o.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (rev j :: xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
        rewrite IHl.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (rev j :: xelements r j~1 acc) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) rewrite InA_cons.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
(E.eq y (rev j) \/ InL y (xelements r j~1 acc)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) rewrite IHr.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) clear IHl IHr.l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) split.l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) ->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
          intros [[H|[H|[x [-> H]]]]|[x [-> H]]]; eauto.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x r = true
InL (j~1 @ x) acc \/
(exists x0 : elt,
   j~1 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
            right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x r = true
exists x0 : elt,
  j~1 @ x = j @ x0 /\
  match x0 with
  | i~1 => mem i r
  | i~0 => mem i l
  | 1 => true
  end = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) exists x~1.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x r = true
j~1 @ x = j @ x~1 /\ mem x r = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) auto.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
            right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
exists x0 : elt,
  j~0 @ x = j @ x0 /\
  match x0 with
  | i~1 => mem i r
  | i~0 => mem i l
  | 1 => true
  end = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) exists x~0.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
j~0 @ x = j @ x~0 /\ mem x l = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) auto.l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => true
   end = true) ->
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
          intros [H|[x [-> H]]].l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
H:InL y acc
(E.eq y (rev j) \/
 InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end = true
(E.eq (j @ x) (rev j) \/
 InL (j @ x) acc \/
 (exists x0 : elt, j @ x = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt, j @ x = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
            eauto.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end = true
(E.eq (j @ x) (rev j) \/
 InL (j @ x) acc \/
 (exists x0 : elt, j @ x = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt, j @ x = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
            destruct x.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x r = true
(E.eq (j @ x~1) (rev j) \/
 InL (j @ x~1) acc \/
 (exists x0 : elt,
    j @ x~1 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~1 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
              left.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x r = true
E.eq (j @ x~1) (rev j) \/
InL (j @ x~1) acc \/
(exists x0 : elt,
   j @ x~1 = j~1 @ x0 /\ mem x0 r = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x r = true
InL (j @ x~1) acc \/
(exists x0 : elt,
   j @ x~1 = j~1 @ x0 /\ mem x0 r = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x r = true
exists x0 : elt, j @ x~1 = j~1 @ x0 /\ mem x0 r = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) exists x; auto.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(E.eq (j @ x~0) (rev j) \/
 InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
              right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
exists x0 : elt, j @ x~0 = j~0 @ x0 /\ mem x0 l = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) exists x; auto.l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
(E.eq (j @ 1) (rev j) \/
 InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
              left.l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
E.eq (j @ 1) (rev j) \/
InL (j @ 1) acc \/
(exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) left.l:tree
o:bool
r:tree
j:elt
acc:list elt
H:true = true
E.eq (j @ 1) (rev j)
l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) reflexivity.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
InL y (xelements l j~0 (xelements r j~1 acc)) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)

        rewrite IHl, IHr.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements l j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x l = true)
IHr:forall (j0 : elt) (acc0 : list elt) (y0 : positive),
InL y0 (xelements r j0 acc0) <->
InL y0 acc0 \/ (exists x : elt, y0 = j0 @ x /\ mem x r = true)
j:elt
acc:list elt
y:positive
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) clear IHl IHr.l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) <->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) split.l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) ->
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
          intros [[H|[x [-> H]]]|[x [-> H]]].l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
H:InL y acc
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x r = true
InL (j~1 @ x) acc \/
(exists x0 : elt,
   j~1 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
            eauto.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x r = true
InL (j~1 @ x) acc \/
(exists x0 : elt,
   j~1 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
            right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x r = true
exists x0 : elt,
  j~1 @ x = j @ x0 /\
  match x0 with
  | i~1 => mem i r
  | i~0 => mem i l
  | 1 => false
  end = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) exists x~1.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x r = true
j~1 @ x = j @ x~1 /\ mem x r = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) auto.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
InL (j~0 @ x) acc \/
(exists x0 : elt,
   j~0 @ x = j @ x0 /\
   match x0 with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
            right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
exists x0 : elt,
  j~0 @ x = j @ x0 /\
  match x0 with
  | i~1 => mem i r
  | i~0 => mem i l
  | 1 => false
  end = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) exists x~0.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:mem x l = true
j~0 @ x = j @ x~0 /\ mem x l = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true) auto.l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
InL y acc \/
(exists x : elt,
   y = j @ x /\
   match x with
   | i~1 => mem i r
   | i~0 => mem i l
   | 1 => false
   end = true) ->
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
          intros [H|[x [-> H]]].l:tree
o:bool
r:tree
j:elt
acc:list elt
y:positive
H:InL y acc
(InL y acc \/
 (exists x : elt, y = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, y = j~0 @ x /\ mem x l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
(InL (j @ x) acc \/
 (exists x0 : elt, j @ x = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt, j @ x = j~0 @ x0 /\ mem x0 l = true)
            eauto.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:elt
H:match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
(InL (j @ x) acc \/
 (exists x0 : elt, j @ x = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt, j @ x = j~0 @ x0 /\ mem x0 l = true)
            destruct x.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x r = true
(InL (j @ x~1) acc \/
 (exists x0 : elt,
    j @ x~1 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~1 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
              left.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x r = true
InL (j @ x~1) acc \/
(exists x0 : elt,
   j @ x~1 = j~1 @ x0 /\ mem x0 r = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true) right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x r = true
exists x0 : elt, j @ x~1 = j~1 @ x0 /\ mem x0 r = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)  exists x; auto.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
(InL (j @ x~0) acc \/
 (exists x0 : elt,
    j @ x~0 = j~1 @ x0 /\ mem x0 r = true)) \/
(exists x0 : elt,
   j @ x~0 = j~0 @ x0 /\ mem x0 l = true)
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
              right.l:tree
o:bool
r:tree
j:elt
acc:list elt
x:positive
H:mem x l = true
exists x0 : elt, j @ x~0 = j~0 @ x0 /\ mem x0 l = true
l:tree
o:bool
r:tree
j:elt
acc:list elt
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true) exists x; auto.l:tree
o:bool
r:tree
j:elt
acc:list elt
H:false = true
(InL (j @ 1) acc \/
 (exists x : elt, j @ 1 = j~1 @ x /\ mem x r = true)) \/
(exists x : elt, j @ 1 = j~0 @ x /\ mem x l = true)
              discriminate.
  Qed.

  Lemma elements_1: forall s x, In x s -> InL x (elements s).forall (s : t) (x : elt), In x s -> InL x (elements s)
  Proof.forall (s : t) (x : elt), In x s -> InL x (elements s)
    unfold elements, In.forall (s : t) (x : elt),
mem x s = true -> InL x (xelements s 1 nil) intros.s:t
x:elt
H:mem x s = true
InL x (xelements s 1 nil)
    rewrite xelements_spec.s:t
x:elt
H:mem x s = true
InL x nil \/
(exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true) right.s:t
x:elt
H:mem x s = true
exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true exists x.s:t
x:elt
H:mem x s = true
x = 1 @ x /\ mem x s = true auto.
  Qed.

  Lemma elements_2: forall s x, InL x (elements s) -> In x s.forall (s : t) (x : positive),
InL x (elements s) -> In x s
  Proof.forall (s : t) (x : positive),
InL x (elements s) -> In x s
    unfold elements, In.forall (s : t) (x : positive),
InL x (xelements s 1 nil) -> mem x s = true intros s x H.s:t
x:positive
H:InL x (xelements s 1 nil)
mem x s = true
    rewrite xelements_spec in H.s:t
x:positive
H:InL x nil \/
(exists x0 : elt, x = 1 @ x0 /\ mem x0 s = true)
mem x s = true destruct H as [H|[y [H H']]].s:t
x:positive
H:InL x nil
mem x s = true
s:t
x:positive
y:elt
H:x = 1 @ y
H':mem y s = true
mem x s = true
      inversion_clear H.s:t
x:positive
y:elt
H:x = 1 @ y
H':mem y s = true
mem x s = true
      rewrite H.s:t
x:positive
y:elt
H:x = 1 @ y
H':mem y s = true
mem (1 @ y) s = true assumption.
  Qed.

  Lemma lt_rev_append: forall j x y, E.lt x y -> E.lt (j@x) (j@y).forall (j : elt) (x y : positive),
E.lt x y -> E.lt (j @ x) (j @ y)
  Proof.forall (j : elt) (x y : positive),
E.lt x y -> E.lt (j @ x) (j @ y) induction j; intros; simpl; auto. Qed.

  Lemma elements_3: forall s, sort E.lt (elements s).forall s : t, Sorted E.lt (elements s)
  Proof.forall s : t, Sorted E.lt (elements s)
    unfold elements.forall s : t, Sorted E.lt (xelements s 1 nil)
    assert (H: forall s j acc,
      sort E.lt acc ->
      (forall x y, In x s ->  InL y acc -> E.lt (j@x) y) ->
      sort E.lt (xelements s j acc)).forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)

    induction s as [|l IHl o r IHr]; simpl; trivial.l:tree
o:bool
r:tree
IHl:forall (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive), In x l -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements l j acc)
IHr:forall (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive), In x r -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements r j acc)
forall (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x (Node l o r) -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
    intros j acc Hacc Hsacc.l:tree
o:bool
r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l o r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt
  (if o
   then xelements l j~0 (rev j :: xelements r j~1 acc)
   else xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) destruct o.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt
  (xelements l j~0 (rev j :: xelements r j~1 acc))
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
      apply IHl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (rev j :: xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) constructor.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       apply IHr.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt acc
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x r -> InL y acc -> E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply Hacc.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x r -> InL y acc -> E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros x y Hx Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x r
Hy:InL y acc
E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply Hsacc; assumption.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
HdRel E.lt (rev j) (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       case_eq (xelements r j~1 acc).l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
xelements r j~1 acc = nil -> HdRel E.lt (rev j) nil
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (e : elt) (l0 : list elt),
xelements r j~1 acc = e :: l0 ->
HdRel E.lt (rev j) (e :: l0)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) constructor.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (e : elt) (l0 : list elt),
xelements r j~1 acc = e :: l0 ->
HdRel E.lt (rev j) (e :: l0)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros z q H.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
HdRel E.lt (rev j) (z :: q)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) constructor.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       assert (H': InL z (xelements r j~1 acc)).l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
InL z (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
        rewrite H.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
InL z (z :: q)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) constructor.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
E.eq z z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) reflexivity.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
q:list elt
H:xelements r j~1 acc = z :: q
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       clear H q.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
H':InL z (xelements r j~1 acc)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) rewrite xelements_spec in H'.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
H':InL z acc \/
(exists x : elt, z = j~1 @ x /\ mem x r = true)
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) destruct H' as [Hy|[x [-> Hx]]].l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
Hy:InL z acc
E.lt (rev j) z
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive),
 In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive),
 In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt (rev j) (j~1 @ x)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         apply (Hsacc 1 z); trivial.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
z:elt
Hy:InL z acc
In 1 (Node l true r)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive),
 In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive),
 In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt (rev j) (j~1 @ x)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) reflexivity.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt (rev j) (j~1 @ x)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt (rev j) (j @ x~1)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply lt_rev_append.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:mem x r = true
E.lt 1 x~1
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) exact I.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l true r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (rev j :: xelements r j~1 acc) ->
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros x y Hx Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
Hy:InL y (rev j :: xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) inversion_clear Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:E.eq y (rev j)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
 In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
 In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         rewrite H.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:E.eq y (rev j)
E.lt (j~0 @ x) (rev j)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
 In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
 In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:E.eq y (rev j)
E.lt (j @ x~0) (rev j)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
 In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
 In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply lt_rev_append.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:E.eq y (rev j)
E.lt x~0 1
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
 In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
 In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) exact I.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         rewrite xelements_spec in H.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
H:InL y acc \/
(exists x0 : elt, y = j~1 @ x0 /\ mem x0 r = true)
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) destruct H as [Hy|[z [-> Hy]]].l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l true r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
Hy:InL y acc
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive),
 In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive),
 In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j~0 @ x) (j~1 @ z)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
           apply Hsacc; assumption.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j~0 @ x) (j~1 @ z)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
           simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j @ x~0) (j @ z~1)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply lt_rev_append.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l true r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:In x l
z:elt
Hy:mem z r = true
E.lt x~0 z~1
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) exact I.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements l j~0 (xelements r j~1 acc))
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)

      apply IHl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt (xelements r j~1 acc)
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply IHr.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
Sorted E.lt acc
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x r -> InL y acc -> E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply Hacc.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x r -> InL y acc -> E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros x y Hx Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l false r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x r
Hy:InL y acc
E.lt (j~1 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive),
 In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply Hsacc; assumption.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x l -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x : elt) (y : positive), In x r -> InL y acc0 -> E.lt (j0 @ x) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x : elt) (y : positive),
In x (Node l false r) ->
InL y acc -> E.lt (j @ x) y
forall (x : elt) (y : positive),
In x l ->
InL y (xelements r j~1 acc) -> E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
       intros x y Hx Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l false r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
Hy:InL y (xelements r j~1 acc)
E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) rewrite xelements_spec in Hy.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l false r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
Hy:InL y acc \/
(exists x0 : elt, y = j~1 @ x0 /\ mem x0 r = true)
E.lt (j~0 @ x) y
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
        destruct Hy as [Hy|[z [-> Hy]]].l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 l -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y0 : positive),
In x0 r -> InL y0 acc0 -> E.lt (j0 @ x0) y0) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y0 : positive),
In x0 (Node l false r) ->
InL y0 acc -> E.lt (j @ x0) y0
x:elt
y:positive
Hx:In x l
Hy:InL y acc
E.lt (j~0 @ x) y
l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive),
 In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive),
 In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l false r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j~0 @ x) (j~1 @ z)
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         apply Hsacc; assumption.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l false r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j~0 @ x) (j~1 @ z)
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)
         simpl.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l false r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:In x l
z:elt
Hy:mem z r = true
E.lt (j @ x~0) (j @ z~1)
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) apply lt_rev_append.l, r:tree
IHl:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 l -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements l j0 acc0)
IHr:forall (j0 : elt) (acc0 : list positive),
Sorted E.lt acc0 ->
(forall (x0 : elt) (y : positive), In x0 r -> InL y acc0 -> E.lt (j0 @ x0) y) ->
Sorted E.lt (xelements r j0 acc0)
j:elt
acc:list positive
Hacc:Sorted E.lt acc
Hsacc:forall (x0 : elt) (y : positive),
In x0 (Node l false r) ->
InL y acc -> E.lt (j @ x0) y
x:elt
Hx:In x l
z:elt
Hy:mem z r = true
E.lt x~0 z~1
H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil) exact I.H:forall (s : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s j acc)
forall s : t, Sorted E.lt (xelements s 1 nil)

    intros.H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s0 -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s0 j acc)
s:t
Sorted E.lt (xelements s 1 nil) apply H.H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s0 -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s0 j acc)
s:t
Sorted E.lt nil
H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s0 -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s0 j acc)
s:t
forall (x : elt) (y : positive),
In x s -> InL y nil -> E.lt (1 @ x) y constructor.H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x : elt) (y : positive),
 In x s0 -> InL y acc -> E.lt (j @ x) y) ->
Sorted E.lt (xelements s0 j acc)
s:t
forall (x : elt) (y : positive),
In x s -> InL y nil -> E.lt (1 @ x) y
      intros x y _ H'.H:forall (s0 : t) (j : elt) (acc : list positive),
Sorted E.lt acc ->
(forall (x0 : elt) (y0 : positive),
 In x0 s0 -> InL y0 acc -> E.lt (j @ x0) y0) ->
Sorted E.lt (xelements s0 j acc)
s:t
x:elt
y:positive
H':InL y nil
E.lt (1 @ x) y inversion H'.
  Qed.

  Lemma elements_3w: forall s, NoDupA E.eq (elements s).forall s : t, NoDupA E.eq (elements s)
  Proof.forall s : t, NoDupA E.eq (elements s)
    intro.s:t
NoDupA E.eq (elements s) apply SortA_NoDupA with E.lt.s:t
Equivalence E.eq
s:t
StrictOrder E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s)
      constructor.s:t
Reflexive E.eq
s:t
Symmetric E.eq
s:t
Transitive E.eq
s:t
StrictOrder E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s)
       intro.s:t
x:positive
E.eq x x
s:t
Symmetric E.eq
s:t
Transitive E.eq
s:t
StrictOrder E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s) apply E.eq_refl.s:t
Symmetric E.eq
s:t
Transitive E.eq
s:t
StrictOrder E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s)
       intro.s:t
x:positive
forall y : positive, E.eq x y -> E.eq y x
s:t
Transitive E.eq
s:t
StrictOrder E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s) apply E.eq_sym.s:t
Transitive E.eq
s:t
StrictOrder E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s)
       intro.s:t
x:positive
forall y z : positive,
E.eq x y -> E.eq y z -> E.eq x z
s:t
StrictOrder E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s) apply E.eq_trans.s:t
StrictOrder E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s)
      constructor.s:t
Irreflexive E.lt
s:t
Transitive E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s)
       intros x H.s:t
x:positive
H:E.lt x x
False
s:t
Transitive E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s) apply E.lt_not_eq in H.s:t
x:positive
H:~ E.eq x x
False
s:t
Transitive E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s) apply H.s:t
x:positive
H:~ E.eq x x
E.eq x x
s:t
Transitive E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s) reflexivity.s:t
Transitive E.lt
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s)
       intro.s:t
x:positive
forall y z : positive,
E.lt x y -> E.lt y z -> E.lt x z
s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s) apply E.lt_trans.s:t
Proper (E.eq ==> E.eq ==> iff) E.lt
s:t
Sorted E.lt (elements s)
     solve_proper.s:t
Sorted E.lt (elements s)
      apply elements_3.
  Qed.

Specification of choose

  Lemma choose_1: forall s x, choose s = Some x -> In x s.forall (s : t) (x : elt), choose s = Some x -> In x s
  Proof.forall (s : t) (x : elt), choose s = Some x -> In x s
    induction s as [| l IHl o r IHr]; simpl.forall x : elt, None = Some x -> In x Leaf
l:tree
o:bool
r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => omap xI (choose r)
  end) = Some x -> In x (Node l o r)
      intros.x:elt
H:None = Some x
In x Leaf
l:tree
o:bool
r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => omap xI (choose r)
  end) = Some x -> In x (Node l o r) discriminate.l:tree
o:bool
r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => omap xI (choose r)
  end) = Some x -> In x (Node l o r)
      destruct o.l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
Some 1 = Some x -> In x (Node l true r)
l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
match choose l with
| Some i => Some i~0
| None => omap xI (choose r)
end = Some x -> In x (Node l false r)
        intros x H.l, r:tree
IHl:forall x0 : elt, choose l = Some x0 -> In x0 l
IHr:forall x0 : elt, choose r = Some x0 -> In x0 r
x:elt
H:Some 1 = Some x
In x (Node l true r)
l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
match choose l with
| Some i => Some i~0
| None => omap xI (choose r)
end = Some x -> In x (Node l false r) injection H; intros; subst.l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
H:Some 1 = Some 1
In 1 (Node l true r)
l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
match choose l with
| Some i => Some i~0
| None => omap xI (choose r)
end = Some x -> In x (Node l false r) reflexivity.l, r:tree
IHl:forall x : elt, choose l = Some x -> In x l
IHr:forall x : elt, choose r = Some x -> In x r
forall x : elt,
match choose l with
| Some i => Some i~0
| None => omap xI (choose r)
end = Some x -> In x (Node l false r)
        revert IHl.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, choose l = Some x -> In x l) ->
forall x : elt,
match choose l with
| Some i => Some i~0
| None => omap xI (choose r)
end = Some x -> In x (Node l false r) case choose.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
forall e : elt,
(forall x : elt, Some e = Some x -> In x l) ->
forall x : elt,
Some e~0 = Some x -> In x (Node l false r)
l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
omap xI (choose r) = Some x -> In x (Node l false r)
          intros p Hp x H.l, r:tree
IHr:forall x0 : elt, choose r = Some x0 -> In x0 r
p:elt
Hp:forall x0 : elt, Some p = Some x0 -> In x0 l
x:elt
H:Some p~0 = Some x
In x (Node l false r)
l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
omap xI (choose r) = Some x -> In x (Node l false r) injection H as <-.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
p:elt
Hp:forall x : elt, Some p = Some x -> In x l
In p~0 (Node l false r)
l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
omap xI (choose r) = Some x -> In x (Node l false r) apply Hp.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
p:elt
Hp:forall x : elt, Some p = Some x -> In x l
Some p = Some p
l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
omap xI (choose r) = Some x -> In x (Node l false r)
           reflexivity.l, r:tree
IHr:forall x : elt, choose r = Some x -> In x r
(forall x : elt, None = Some x -> In x l) ->
forall x : elt,
omap xI (choose r) = Some x -> In x (Node l false r)
          intros _ x.l, r:tree
IHr:forall x0 : elt, choose r = Some x0 -> In x0 r
x:elt
omap xI (choose r) = Some x -> In x (Node l false r) revert IHr.l, r:tree
x:elt
(forall x0 : elt, choose r = Some x0 -> In x0 r) ->
omap xI (choose r) = Some x -> In x (Node l false r) case choose.l, r:tree
x:elt
forall e : elt,
(forall x0 : elt, Some e = Some x0 -> In x0 r) ->
omap xI (Some e) = Some x -> In x (Node l false r)
l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
omap xI None = Some x -> In x (Node l false r)
            intros p Hp H.l, r:tree
x, p:elt
Hp:forall x0 : elt, Some p = Some x0 -> In x0 r
H:omap xI (Some p) = Some x
In x (Node l false r)
l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
omap xI None = Some x -> In x (Node l false r) injection H as <-.l, r:tree
p:elt
Hp:forall x : elt, Some p = Some x -> In x r
In p~1 (Node l false r)
l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
omap xI None = Some x -> In x (Node l false r) apply Hp.l, r:tree
p:elt
Hp:forall x : elt, Some p = Some x -> In x r
Some p = Some p
l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
omap xI None = Some x -> In x (Node l false r)
            reflexivity.l, r:tree
x:elt
(forall x0 : elt, None = Some x0 -> In x0 r) ->
omap xI None = Some x -> In x (Node l false r)
            intros.l, r:tree
x:elt
IHr:forall x0 : elt, None = Some x0 -> In x0 r
H:omap xI None = Some x
In x (Node l false r) discriminate.
  Qed.

  Lemma choose_2: forall s, choose s = None -> Empty s.forall s : t, choose s = None -> Empty s
  Proof.forall s : t, choose s = None -> Empty s
    unfold Empty, In.forall s : t,
choose s = None -> forall a : elt, mem a s <> true intros s H.s:t
H:choose s = None
forall a : elt, mem a s <> true
    induction s as [|l IHl o r IHr].H:choose Leaf = None
forall a : elt, mem a Leaf <> true
l:tree
o:bool
r:tree
H:choose (Node l o r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intro.H:choose Leaf = None
a:elt
mem a Leaf <> true
l:tree
o:bool
r:tree
H:choose (Node l o r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true apply empty_1.l:tree
o:bool
r:tree
H:choose (Node l o r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      destruct o.l, r:tree
H:choose (Node l true r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l true r) <> true
l, r:tree
H:choose (Node l false r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
        discriminate.l, r:tree
H:choose (Node l false r) = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
        simpl in H.l, r:tree
H:match choose l with
| Some i => Some i~0
| None => omap xI (choose r)
end = None
IHl:choose l = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true destruct (choose l).l, r:tree
e:elt
H:Some e~0 = None
IHl:Some e = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
l, r:tree
H:omap xI (choose r) = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
          discriminate.l, r:tree
H:omap xI (choose r) = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:choose r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
          destruct (choose r).l, r:tree
e:elt
H:omap xI (Some e) = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:Some e = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
l, r:tree
H:omap xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
            discriminate.l, r:tree
H:omap xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l false r) <> true
            intros [a|a|].l, r:tree
H:omap xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~1 (Node l false r) <> true
l, r:tree
H:omap xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l false r) <> true
l, r:tree
H:omap xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true
              apply IHr.l, r:tree
H:omap xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
None = None
l, r:tree
H:omap xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l false r) <> true
l, r:tree
H:omap xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true reflexivity.l, r:tree
H:omap xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l false r) <> true
l, r:tree
H:omap xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true
              apply IHl.l, r:tree
H:omap xI None = None
IHl:None = None -> forall a0 : elt, mem a0 l <> true
IHr:None = None -> forall a0 : elt, mem a0 r <> true
a:positive
None = None
l, r:tree
H:omap xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true reflexivity.l, r:tree
H:omap xI None = None
IHl:None = None -> forall a : elt, mem a l <> true
IHr:None = None -> forall a : elt, mem a r <> true
mem 1 (Node l false r) <> true
              discriminate.
  Qed.

  Lemma choose_empty: forall s, is_empty s = true -> choose s = None.forall s : t, is_empty s = true -> choose s = None
  Proof.forall s : t, is_empty s = true -> choose s = None
    intros s Hs.s:t
Hs:is_empty s = true
choose s = None case_eq (choose s); trivial.s:t
Hs:is_empty s = true
forall e : elt, choose s = Some e -> Some e = None
    intros p Hp.s:t
Hs:is_empty s = true
p:elt
Hp:choose s = Some p
Some p = None apply choose_1 in Hp.s:t
Hs:is_empty s = true
p:elt
Hp:In p s
Some p = None apply is_empty_2 in Hs.s:t
Hs:Empty s
p:elt
Hp:In p s
Some p = None elim (Hs _ Hp).
  Qed.

  Lemma choose_3': forall s s', Equal s s' -> choose s = choose s'.forall s s' : t, s [=] s' -> choose s = choose s'
  Proof.forall s s' : t, s [=] s' -> choose s = choose s'
    setoid_rewrite equal_spec.forall s s' : t,
equal s s' = true -> choose s = choose s'
    induction s as [|l IHl o r IHr].forall s' : t,
equal Leaf s' = true -> choose Leaf = choose s'
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s'
      intros.s':t
H:equal Leaf s' = true
choose Leaf = choose s'
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s' symmetry.s':t
H:equal Leaf s' = true
choose s' = choose Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s' apply choose_empty.s':t
H:equal Leaf s' = true
is_empty s' = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s' assumption.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s' : t,
equal (Node l o r) s' = true ->
choose (Node l o r) = choose s'

      destruct s' as [|l' o' r'].l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
equal (Node l o r) Leaf = true ->
choose (Node l o r) = choose Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r')
        generalize (Node l o r) as s.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s : tree,
equal s Leaf = true -> choose s = choose Leaf
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') simpl.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
forall s : tree,
equal s Leaf = true -> choose s = None
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') intros.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:equal s Leaf = true
choose s = None
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') apply choose_empty.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:equal s Leaf = true
is_empty s = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r')
        rewrite <- equal_spec in H.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:s [=] Leaf
is_empty s = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') apply eq_sym in H.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:eq Leaf s
is_empty s = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r') rewrite equal_spec in H.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
s:tree
H:equal Leaf s = true
is_empty s = true
l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r')
        assumption.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
equal (Node l o r) (Node l' o' r') = true ->
choose (Node l o r) = choose (Node l' o' r')

        simpl.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
eqb o o' &&& equal l l' &&& equal r r' = true ->
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => omap xI (choose r)
  end) =
(if o'
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => omap xI (choose r')
  end) rewrite <- 2andb_lazy_alt, 2andb_true_iff, eqb_true_iff.l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l':tree
o':bool
r':tree
(o = o' /\ equal l l' = true) /\ equal r r' = true ->
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => omap xI (choose r)
  end) =
(if o'
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => omap xI (choose r')
  end)
        intros [[<- Hl] Hr].l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l', r':tree
Hl:equal l l' = true
Hr:equal r r' = true
(if o
 then Some 1
 else
  match choose l with
  | Some i => Some i~0
  | None => omap xI (choose r)
  end) =
(if o
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => omap xI (choose r')
  end) rewrite (IHl _ Hl), (IHr _ Hr).l:tree
o:bool
r:tree
IHl:forall s' : t, equal l s' = true -> choose l = choose s'
IHr:forall s' : t, equal r s' = true -> choose r = choose s'
l', r':tree
Hl:equal l l' = true
Hr:equal r r' = true
(if o
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => omap xI (choose r')
  end) =
(if o
 then Some 1
 else
  match choose l' with
  | Some i => Some i~0
  | None => omap xI (choose r')
  end) reflexivity.
  Qed.

  Lemma choose_3: forall s s' x y,
    choose s = Some x -> choose s' = Some y -> Equal s s' -> E.eq x y.forall (s s' : t) (x y : elt),
choose s = Some x ->
choose s' = Some y -> s [=] s' -> E.eq x y
  Proof.forall (s s' : t) (x y : elt),
choose s = Some x ->
choose s' = Some y -> s [=] s' -> E.eq x y intros s s' x y Hx Hy H.s, s':t
x, y:elt
Hx:choose s = Some x
Hy:choose s' = Some y
H:s [=] s'
E.eq x y apply choose_3' in H.s, s':t
x, y:elt
Hx:choose s = Some x
Hy:choose s' = Some y
H:choose s = choose s'
E.eq x y congruence. Qed.

Specification of min_elt

  Lemma min_elt_1: forall s x, min_elt s = Some x -> In x s.forall (s : t) (x : elt), min_elt s = Some x -> In x s
  Proof.forall (s : t) (x : elt), min_elt s = Some x -> In x s
   unfold In.forall (s : t) (x : elt),
min_elt s = Some x -> mem x s = true
   induction s as [| l IHl o r IHr]; simpl.forall x : elt, None = Some x -> false = true
l:tree
o:bool
r:tree
IHl:forall x : elt, min_elt l = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
forall x : elt,
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else omap xI (min_elt r)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
     intros.x:elt
H:None = Some x
false = true
l:tree
o:bool
r:tree
IHl:forall x : elt, min_elt l = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
forall x : elt,
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else omap xI (min_elt r)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true discriminate.l:tree
o:bool
r:tree
IHl:forall x : elt, min_elt l = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
forall x : elt,
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else omap xI (min_elt r)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
     intros x.l:tree
o:bool
r:tree
IHl:forall x0 : elt, min_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else omap xI (min_elt r)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true destruct (min_elt l); intros.l:tree
o:bool
r:tree
e:elt
IHl:forall x0 : elt, Some e = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:Some e~0 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
l:tree
o:bool
r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else omap xI (min_elt r)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
       injection H as <-.l:tree
o:bool
r:tree
e:elt
IHl:forall x : elt, Some e = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
mem e l = true
l:tree
o:bool
r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else omap xI (min_elt r)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true apply IHl.l:tree
o:bool
r:tree
e:elt
IHl:forall x : elt, Some e = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
Some e = Some e
l:tree
o:bool
r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else omap xI (min_elt r)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true reflexivity.l:tree
o:bool
r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else omap xI (min_elt r)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
       destruct o; simpl.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:Some 1 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:omap xI (min_elt r) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
         injection H as <-.l, r:tree
IHl:forall x : elt, None = Some x -> mem x l = true
IHr:forall x : elt, min_elt r = Some x -> mem x r = true
true = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:omap xI (min_elt r) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true reflexivity.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, min_elt r = Some x0 -> mem x0 r = true
x:elt
H:omap xI (min_elt r) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
         destruct (min_elt r); simpl in *.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
e:elt
IHr:forall x0 : elt, Some e = Some x0 -> mem x0 r = true
x:elt
H:Some e~1 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
           injection H as <-.l, r:tree
IHl:forall x : elt, None = Some x -> mem x l = true
e:elt
IHr:forall x : elt, Some e = Some x -> mem x r = true
mem e r = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true apply IHr.l, r:tree
IHl:forall x : elt, None = Some x -> mem x l = true
e:elt
IHr:forall x : elt, Some e = Some x -> mem x r = true
Some e = Some e
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true reflexivity.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
           discriminate.
  Qed.

  Lemma min_elt_3: forall s, min_elt s = None -> Empty s.forall s : t, min_elt s = None -> Empty s
  Proof.forall s : t, min_elt s = None -> Empty s
    unfold Empty, In.forall s : t,
min_elt s = None -> forall a : elt, mem a s <> true intros s H.s:t
H:min_elt s = None
forall a : elt, mem a s <> true
    induction s as [|l IHl o r IHr].H:min_elt Leaf = None
forall a : elt, mem a Leaf <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intro.H:min_elt Leaf = None
a:elt
mem a Leaf <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true apply empty_1.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intros [a|a|].l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~1 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        apply IHr.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
min_elt r = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true revert H.l:tree
o:bool
r:tree
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
min_elt (Node l o r) = None -> min_elt r = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
min_elt (Node l o r) = None -> min_elt r = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else omap xI (min_elt r)
end = None -> min_elt r = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct (min_elt r); trivial.l:tree
o:bool
r:tree
e:elt
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else omap xI (Some e)
end = None -> Some e = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
          case min_elt; intros; try discriminate.l:tree
o:bool
r:tree
e:elt
H:(if o then Some 1 else omap xI (Some e)) = None
Some e = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct o; discriminate.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        apply IHl.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
min_elt l = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true revert H.l:tree
o:bool
r:tree
IHl:min_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:min_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
min_elt (Node l o r) = None -> min_elt l = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
min_elt (Node l o r) = None -> min_elt l = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else omap xI (min_elt r)
end = None -> min_elt l = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct (min_elt l); trivial.l:tree
o:bool
r:tree
e:elt
Some e~0 = None -> Some e = None
l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
         intro; discriminate.l:tree
o:bool
r:tree
H:min_elt (Node l o r) = None
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        revert H.l:tree
o:bool
r:tree
IHl:min_elt l = None -> forall a : elt, mem a l <> true
IHr:min_elt r = None -> forall a : elt, mem a r <> true
min_elt (Node l o r) = None ->
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
min_elt (Node l o r) = None ->
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match min_elt l with
| Some i => Some i~0
| None => if o then Some 1 else omap xI (min_elt r)
end = None -> o <> true case min_elt; intros; try discriminate.l:tree
o:bool
r:tree
H:(if o then Some 1 else omap xI (min_elt r)) = None
o <> true
         destruct o; discriminate.
  Qed.

  Lemma min_elt_2: forall s x y, min_elt s = Some x -> In y s -> ~ E.lt y x.forall (s : t) (x y : elt),
min_elt s = Some x -> In y s -> ~ E.lt y x
  Proof.forall (s : t) (x y : elt),
min_elt s = Some x -> In y s -> ~ E.lt y x
    unfold In.forall (s : t) (x y : elt),
min_elt s = Some x -> mem y s = true -> ~ E.lt y x
    induction s as [|l IHl o r IHr]; intros x y H H'.x, y:elt
H:min_elt Leaf = Some x
H':mem y Leaf = true
~ E.lt y x
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:min_elt (Node l o r) = Some x
H':mem y (Node l o r) = true
~ E.lt y x
      discriminate.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:min_elt (Node l o r) = Some x
H':mem y (Node l o r) = true
~ E.lt y x
      simpl in H.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
~ E.lt y x case_eq (min_elt l).l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
forall e : elt, min_elt l = Some e -> ~ E.lt y x
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x
        intros p Hp.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
p:elt
Hp:min_elt l = Some p
~ E.lt y x
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x rewrite Hp in H.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y, p:elt
H:Some p~0 = Some x
H':mem y (Node l o r) = true
Hp:min_elt l = Some p
~ E.lt y x
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x injection H as <-.l:tree
o:bool
r:tree
IHl:forall x y0 : elt, min_elt l = Some x -> mem y0 l = true -> ~ E.lt y0 x
IHr:forall x y0 : elt, min_elt r = Some x -> mem y0 r = true -> ~ E.lt y0 x
y, p:elt
H':mem y (Node l o r) = true
Hp:min_elt l = Some p
~ E.lt y p~0
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x
        destruct y as [z|z|]; simpl; intro; trivial.l:tree
o:bool
r:tree
IHl:forall x y : elt, min_elt l = Some x -> mem y l = true -> ~ E.lt y x
IHr:forall x y : elt, min_elt r = Some x -> mem y r = true -> ~ E.lt y x
z:positive
p:elt
H':mem z~0 (Node l o r) = true
Hp:min_elt l = Some p
H:E.lt z p
False
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x apply (IHl p z); trivial.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:match min_elt l with
| Some i => Some i~0
| None =>
    if o then Some 1 else omap xI (min_elt r)
end = Some x
H':mem y (Node l o r) = true
min_elt l = None -> ~ E.lt y x
        intro Hp; rewrite Hp in H.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:(if o then Some 1 else omap xI (min_elt r)) =
Some x
H':mem y (Node l o r) = true
Hp:min_elt l = None
~ E.lt y x apply min_elt_3 in Hp.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:(if o then Some 1 else omap xI (min_elt r)) =
Some x
H':mem y (Node l o r) = true
Hp:Empty l
~ E.lt y x
        destruct o.l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:Some 1 = Some x
H':mem y (Node l true r) = true
Hp:Empty l
~ E.lt y x
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
          injection H as <-.l, r:tree
IHl:forall x y0 : elt, min_elt l = Some x -> mem y0 l = true -> ~ E.lt y0 x
IHr:forall x y0 : elt, min_elt r = Some x -> mem y0 r = true -> ~ E.lt y0 x
y:elt
H':mem y (Node l true r) = true
Hp:Empty l
~ E.lt y 1
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x intros Hl.l, r:tree
IHl:forall x y0 : elt, min_elt l = Some x -> mem y0 l = true -> ~ E.lt y0 x
IHr:forall x y0 : elt, min_elt r = Some x -> mem y0 r = true -> ~ E.lt y0 x
y:elt
H':mem y (Node l true r) = true
Hp:Empty l
Hl:E.lt y 1
False
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
          destruct y as [z|z|]; simpl; trivial.l, r:tree
IHl:forall x y : elt, min_elt l = Some x -> mem y l = true -> ~ E.lt y x
IHr:forall x y : elt, min_elt r = Some x -> mem y r = true -> ~ E.lt y x
z:positive
H':mem z~0 (Node l true r) = true
Hp:Empty l
Hl:E.lt z~0 1
False
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x elim (Hp _ H').l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, min_elt r = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI (min_elt r) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x

          destruct (min_elt r).l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
e:elt
IHr:forall x0 y0 : elt, Some e = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI (Some e) = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
            injection H as <-.l, r:tree
IHl:forall x y0 : elt, min_elt l = Some x -> mem y0 l = true -> ~ E.lt y0 x
e:elt
IHr:forall x y0 : elt, Some e = Some x -> mem y0 r = true -> ~ E.lt y0 x
y:elt
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y e~1
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
            destruct y as [z|z|].l, r:tree
IHl:forall x y : elt, min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall x y : elt, Some e = Some x -> mem y r = true -> ~ E.lt y x
z:positive
H':mem z~1 (Node l false r) = true
Hp:Empty l
~ E.lt z~1 e~1
l, r:tree
IHl:forall x y : elt, min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall x y : elt, Some e = Some x -> mem y r = true -> ~ E.lt y x
z:positive
H':mem z~0 (Node l false r) = true
Hp:Empty l
~ E.lt z~0 e~1
l, r:tree
IHl:forall x y : elt, min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall x y : elt, Some e = Some x -> mem y r = true -> ~ E.lt y x
H':mem 1 (Node l false r) = true
Hp:Empty l
~ E.lt 1 e~1
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
              apply (IHr e z); trivial.l, r:tree
IHl:forall x y : elt, min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall x y : elt, Some e = Some x -> mem y r = true -> ~ E.lt y x
z:positive
H':mem z~0 (Node l false r) = true
Hp:Empty l
~ E.lt z~0 e~1
l, r:tree
IHl:forall x y : elt, min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall x y : elt, Some e = Some x -> mem y r = true -> ~ E.lt y x
H':mem 1 (Node l false r) = true
Hp:Empty l
~ E.lt 1 e~1
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
              elim (Hp _ H').l, r:tree
IHl:forall x y : elt, min_elt l = Some x -> mem y l = true -> ~ E.lt y x
e:elt
IHr:forall x y : elt, Some e = Some x -> mem y r = true -> ~ E.lt y x
H':mem 1 (Node l false r) = true
Hp:Empty l
~ E.lt 1 e~1
l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
              discriminate.l, r:tree
IHl:forall x0 y0 : elt, min_elt l = Some x0 -> mem y0 l = true -> ~ E.lt y0 x0
IHr:forall x0 y0 : elt, None = Some x0 -> mem y0 r = true -> ~ E.lt y0 x0
x, y:elt
H:omap xI None = Some x
H':mem y (Node l false r) = true
Hp:Empty l
~ E.lt y x
            discriminate.
  Qed.

Specification of max_elt

  Lemma max_elt_1: forall s x, max_elt s = Some x -> In x s.forall (s : t) (x : elt), max_elt s = Some x -> In x s
  Proof.forall (s : t) (x : elt), max_elt s = Some x -> In x s
   unfold In.forall (s : t) (x : elt),
max_elt s = Some x -> mem x s = true
   induction s as [| l IHl o r IHr]; simpl.forall x : elt, None = Some x -> false = true
l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
IHr:forall x : elt, max_elt r = Some x -> mem x r = true
forall x : elt,
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else omap xO (max_elt l)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
     intros.x:elt
H:None = Some x
false = true
l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
IHr:forall x : elt, max_elt r = Some x -> mem x r = true
forall x : elt,
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else omap xO (max_elt l)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true discriminate.l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
IHr:forall x : elt, max_elt r = Some x -> mem x r = true
forall x : elt,
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else omap xO (max_elt l)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
     intros x.l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, max_elt r = Some x0 -> mem x0 r = true
x:elt
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else omap xO (max_elt l)
end = Some x ->
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true destruct (max_elt r); intros.l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
e:elt
IHr:forall x0 : elt, Some e = Some x0 -> mem x0 r = true
x:elt
H:Some e~1 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else omap xO (max_elt l)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
       injection H as <-.l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
e:elt
IHr:forall x : elt, Some e = Some x -> mem x r = true
mem e r = true
l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else omap xO (max_elt l)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true apply IHr.l:tree
o:bool
r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
e:elt
IHr:forall x : elt, Some e = Some x -> mem x r = true
Some e = Some e
l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else omap xO (max_elt l)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true reflexivity.l:tree
o:bool
r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:(if o then Some 1 else omap xO (max_elt l)) =
Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => o
end = true
       destruct o; simpl.l, r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:Some 1 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => true
end = true
l, r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:omap xO (max_elt l) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
         injection H as <-.l, r:tree
IHl:forall x : elt, max_elt l = Some x -> mem x l = true
IHr:forall x : elt, None = Some x -> mem x r = true
true = true
l, r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:omap xO (max_elt l) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true reflexivity.l, r:tree
IHl:forall x0 : elt, max_elt l = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:omap xO (max_elt l) = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
         destruct (max_elt l); simpl in *.l, r:tree
e:elt
IHl:forall x0 : elt, Some e = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:Some e~0 = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
           injection H as <-.l, r:tree
e:elt
IHl:forall x : elt, Some e = Some x -> mem x l = true
IHr:forall x : elt, None = Some x -> mem x r = true
mem e l = true
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true apply IHl.l, r:tree
e:elt
IHl:forall x : elt, Some e = Some x -> mem x l = true
IHr:forall x : elt, None = Some x -> mem x r = true
Some e = Some e
l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true reflexivity.l, r:tree
IHl:forall x0 : elt, None = Some x0 -> mem x0 l = true
IHr:forall x0 : elt, None = Some x0 -> mem x0 r = true
x:elt
H:None = Some x
match x with
| i~1 => mem i r
| i~0 => mem i l
| 1 => false
end = true
           discriminate.
  Qed.

  Lemma max_elt_3: forall s, max_elt s = None -> Empty s.forall s : t, max_elt s = None -> Empty s
  Proof.forall s : t, max_elt s = None -> Empty s
    unfold Empty, In.forall s : t,
max_elt s = None -> forall a : elt, mem a s <> true intros s H.s:t
H:max_elt s = None
forall a : elt, mem a s <> true
    induction s as [|l IHl o r IHr].H:max_elt Leaf = None
forall a : elt, mem a Leaf <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intro.H:max_elt Leaf = None
a:elt
mem a Leaf <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true apply empty_1.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
forall a : elt, mem a (Node l o r) <> true
      intros [a|a|].l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~1 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        apply IHr.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
max_elt r = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true revert H.l:tree
o:bool
r:tree
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
max_elt (Node l o r) = None -> max_elt r = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
max_elt (Node l o r) = None -> max_elt r = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else omap xO (max_elt l)
end = None -> max_elt r = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct (max_elt r); trivial.l:tree
o:bool
r:tree
e:elt
Some e~1 = None -> Some e = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
         intro; discriminate.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
mem a~0 (Node l o r) <> true
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        apply IHl.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
max_elt l = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true revert H.l:tree
o:bool
r:tree
IHl:max_elt l = None -> forall a0 : elt, mem a0 l <> true
IHr:max_elt r = None -> forall a0 : elt, mem a0 r <> true
a:positive
max_elt (Node l o r) = None -> max_elt l = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
max_elt (Node l o r) = None -> max_elt l = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else omap xO (max_elt l)
end = None -> max_elt l = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct (max_elt l); trivial.l:tree
o:bool
r:tree
e:elt
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else omap xO (Some e)
end = None -> Some e = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
          case max_elt; intros; try discriminate.l:tree
o:bool
r:tree
e:elt
H:(if o then Some 1 else omap xO (Some e)) = None
Some e = None
l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true destruct o; discriminate.l:tree
o:bool
r:tree
H:max_elt (Node l o r) = None
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
mem 1 (Node l o r) <> true
        revert H.l:tree
o:bool
r:tree
IHl:max_elt l = None -> forall a : elt, mem a l <> true
IHr:max_elt r = None -> forall a : elt, mem a r <> true
max_elt (Node l o r) = None ->
mem 1 (Node l o r) <> true clear.l:tree
o:bool
r:tree
max_elt (Node l o r) = None ->
mem 1 (Node l o r) <> true simpl.l:tree
o:bool
r:tree
match max_elt r with
| Some i => Some i~1
| None => if o then Some 1 else omap xO (max_elt l)
end = None -> o <> true case max_elt; intros; try discriminate.l:tree
o:bool
r:tree
H:(if o then Some 1 else omap xO (max_elt l)) = None
o <> true
         destruct o; discriminate.
  Qed.

  Lemma max_elt_2: forall s x y, max_elt s = Some x -> In y s -> ~ E.lt x y.forall (s : t) (x y : elt),
max_elt s = Some x -> In y s -> ~ E.lt x y
  Proof.forall (s : t) (x y : elt),
max_elt s = Some x -> In y s -> ~ E.lt x y
    unfold In.forall (s : t) (x y : elt),
max_elt s = Some x -> mem y s = true -> ~ E.lt x y
    induction s as [|l IHl o r IHr]; intros x y H H'.x, y:elt
H:max_elt Leaf = Some x
H':mem y Leaf = true
~ E.lt x y
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:max_elt (Node l o r) = Some x
H':mem y (Node l o r) = true
~ E.lt x y
      discriminate.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:max_elt (Node l o r) = Some x
H':mem y (Node l o r) = true
~ E.lt x y
      simpl in H.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
~ E.lt x y case_eq (max_elt r).l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
forall e : elt, max_elt r = Some e -> ~ E.lt x y
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y
        intros p Hp.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
p:elt
Hp:max_elt r = Some p
~ E.lt x y
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y rewrite Hp in H.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y, p:elt
H:Some p~1 = Some x
H':mem y (Node l o r) = true
Hp:max_elt r = Some p
~ E.lt x y
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y injection H as <-.l:tree
o:bool
r:tree
IHl:forall x y0 : elt, max_elt l = Some x -> mem y0 l = true -> ~ E.lt x y0
IHr:forall x y0 : elt, max_elt r = Some x -> mem y0 r = true -> ~ E.lt x y0
y, p:elt
H':mem y (Node l o r) = true
Hp:max_elt r = Some p
~ E.lt p~1 y
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y
        destruct y as [z|z|]; simpl; intro; trivial.l:tree
o:bool
r:tree
IHl:forall x y : elt, max_elt l = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall x y : elt, max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
p:elt
H':mem z~1 (Node l o r) = true
Hp:max_elt r = Some p
H:E.lt p z
False
l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y apply (IHr p z); trivial.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:match max_elt r with
| Some i => Some i~1
| None =>
    if o then Some 1 else omap xO (max_elt l)
end = Some x
H':mem y (Node l o r) = true
max_elt r = None -> ~ E.lt x y
        intro Hp; rewrite Hp in H.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:(if o then Some 1 else omap xO (max_elt l)) =
Some x
H':mem y (Node l o r) = true
Hp:max_elt r = None
~ E.lt x y apply max_elt_3 in Hp.l:tree
o:bool
r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:(if o then Some 1 else omap xO (max_elt l)) =
Some x
H':mem y (Node l o r) = true
Hp:Empty r
~ E.lt x y
        destruct o.l, r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:Some 1 = Some x
H':mem y (Node l true r) = true
Hp:Empty r
~ E.lt x y
l, r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
          injection H as <-.l, r:tree
IHl:forall x y0 : elt, max_elt l = Some x -> mem y0 l = true -> ~ E.lt x y0
IHr:forall x y0 : elt, max_elt r = Some x -> mem y0 r = true -> ~ E.lt x y0
y:elt
H':mem y (Node l true r) = true
Hp:Empty r
~ E.lt 1 y
l, r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y intros Hl.l, r:tree
IHl:forall x y0 : elt, max_elt l = Some x -> mem y0 l = true -> ~ E.lt x y0
IHr:forall x y0 : elt, max_elt r = Some x -> mem y0 r = true -> ~ E.lt x y0
y:elt
H':mem y (Node l true r) = true
Hp:Empty r
Hl:E.lt 1 y
False
l, r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
          destruct y as [z|z|]; simpl; trivial.l, r:tree
IHl:forall x y : elt, max_elt l = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall x y : elt, max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
H':mem z~1 (Node l true r) = true
Hp:Empty r
Hl:E.lt 1 z~1
False
l, r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y elim (Hp _ H').l, r:tree
IHl:forall x0 y0 : elt, max_elt l = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO (max_elt l) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y

          destruct (max_elt l).l, r:tree
e:elt
IHl:forall x0 y0 : elt, Some e = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO (Some e) = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
l, r:tree
IHl:forall x0 y0 : elt, None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
            injection H as <-.l, r:tree
e:elt
IHl:forall x y0 : elt, Some e = Some x -> mem y0 l = true -> ~ E.lt x y0
IHr:forall x y0 : elt, max_elt r = Some x -> mem y0 r = true -> ~ E.lt x y0
y:elt
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt e~0 y
l, r:tree
IHl:forall x0 y0 : elt, None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
            destruct y as [z|z|].l, r:tree
e:elt
IHl:forall x y : elt, Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall x y : elt, max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
H':mem z~1 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 z~1
l, r:tree
e:elt
IHl:forall x y : elt, Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall x y : elt, max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
H':mem z~0 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 z~0
l, r:tree
e:elt
IHl:forall x y : elt, Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall x y : elt, max_elt r = Some x -> mem y r = true -> ~ E.lt x y
H':mem 1 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 1
l, r:tree
IHl:forall x0 y0 : elt, None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
              elim (Hp _ H').l, r:tree
e:elt
IHl:forall x y : elt, Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall x y : elt, max_elt r = Some x -> mem y r = true -> ~ E.lt x y
z:positive
H':mem z~0 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 z~0
l, r:tree
e:elt
IHl:forall x y : elt, Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall x y : elt, max_elt r = Some x -> mem y r = true -> ~ E.lt x y
H':mem 1 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 1
l, r:tree
IHl:forall x0 y0 : elt, None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
              apply (IHl e z); trivial.l, r:tree
e:elt
IHl:forall x y : elt, Some e = Some x -> mem y l = true -> ~ E.lt x y
IHr:forall x y : elt, max_elt r = Some x -> mem y r = true -> ~ E.lt x y
H':mem 1 (Node l false r) = true
Hp:Empty r
~ E.lt e~0 1
l, r:tree
IHl:forall x0 y0 : elt, None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
              discriminate.l, r:tree
IHl:forall x0 y0 : elt, None = Some x0 -> mem y0 l = true -> ~ E.lt x0 y0
IHr:forall x0 y0 : elt, max_elt r = Some x0 -> mem y0 r = true -> ~ E.lt x0 y0
x, y:elt
H:omap xO None = Some x
H':mem y (Node l false r) = true
Hp:Empty r
~ E.lt x y
            discriminate.
  Qed.

End PositiveSet.